SC-100 Practice Test 3 — 30 Questions

Question 1

A small business uses Microsoft 365 Business Premium and wants to secure their Windows 10 devices with Microsoft Intune. They need to ensure that only devices compliant with the company's security policies can access corporate email. What should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conditional Access policy requiring compliant device. Conditional Access in Microsoft Entra ID can require device compliance before granting access to Exchange Online. Device compliance policies in Intune define the security requirements. Microsoft Entra application proxy is for on-prem apps. Microsoft Defender for Cloud Apps is for cloud app security. Windows Defender Firewall is for network security.

Answer

Azure AD Application Proxy

Answer

Windows Defender Firewall rules

Answer

Microsoft Defender for Cloud Apps session policy

Question 2

Your organization is planning to use Microsoft Sentinel for security information and event management (SIEM). You need to ingest security logs from on-premises Active Directory. What should you deploy?

Accepted Answer

Azure Monitor Agent. The correct option is D, Azure Monitor Agent (AMA). AMA is the current, supported agent for collecting data into Log Analytics workspaces, which back Microsoft Sentinel, and it supports Data Collection Rules (DCRs) to ingest Windows security events from on-premises Active Directory domain controllers via the Azure Arc-enabled servers or the AMA extension. The Microsoft Monitoring Agent (A) and the Log Analytics agent (B) are legacy agents that are deprecated for Sentinel data collection and are being replaced by AMA. The Microsoft Defender for Cloud agent (C) is not a standalone log-ingestion agent for Sentinel; Defender for Cloud uses the Log Analytics/AMA agents for data collection, so it does not fit the requirement directly.

Answer

Microsoft Monitoring Agent (MMA)

Answer

Log Analytics agent

Answer

Microsoft Defender for Cloud agent

Question 3

Your team develops a web application hosted on Azure App Service. You need to secure the application against common web vulnerabilities like SQL injection and cross-site scripting. What should you implement?

Accepted Answer

Enable Azure Web Application Firewall (WAF) on Azure Front Door or Application Gateway.. The correct option is A: enabling Azure Web Application Firewall (WAF) on Azure Front Door or Application Gateway, because WAF provides managed rule sets (OWASP Core Rule Set) that inspect HTTP/HTTPS traffic and block layer 7 attacks such as SQL injection and cross-site scripting before they reach the App Service. Options B, C, and D do not address application-layer attacks: Key Vault with managed identity only protects secrets and credentials, NSGs filter traffic by IP/port/protocol at layers 3-4 and cannot detect SQLi or XSS payloads, and Azure DDoS Protection mitigates volumetric network-layer floods rather than web application vulnerabilities.

Answer

Store application secrets in Azure Key Vault and enable managed identity.

Answer

Configure Network Security Groups (NSGs) on the App Service subnet to restrict inbound traffic.

Answer

Enable Azure DDoS Protection on the virtual network.

Question 4

You are designing a solution to protect an Azure App Service web application from common web attacks like SQL injection and cross-site scripting. What should you implement?

Accepted Answer

Azure Web Application Firewall (WAF) policy on Azure Front Door. Azure Web Application Firewall (WAF) policy on Azure Front Door (option C) is correct because WAF is specifically designed to inspect HTTP/HTTPS traffic and block Layer 7 attacks such as SQL injection and cross-site scripting using managed rule sets (OWASP rules). Azure Front Door provides global edge delivery and integrates WAF policies directly, making it the appropriate choice for protecting a public web application. Azure Firewall (A) is a Layer 3-4 network firewall with limited FQDN filtering and does not provide OWASP-style web attack protection. Azure DDoS Protection (B) mitigates volumetric and protocol-level attacks, not application-layer injection or scripting attacks. NSGs (D) filter traffic by IP, port, and protocol at the network layer and cannot inspect HTTP payloads for SQLi or XSS.

Answer

Azure Firewall

Answer

Azure DDoS Protection

Answer

Network Security Groups (NSGs) on the subnet

Question 5

Refer to the exhibit. What is the effect of this Azure Policy definition?

Accepted Answer

It denies creation or update of storage accounts that do not enforce HTTPS traffic.. The correct option is B: it denies creation or update of storage accounts that do not enforce HTTPS traffic. An Azure Policy definition with a deny effect targeting the Microsoft.Storage/storageAccounts resource type and the supportsHttpsTrafficOnly property blocks any create or update request where that property is false or missing, enforcing secure transfer. Option A is wrong because the policy targets storage accounts, not virtual networks, and HTTPS enforcement is not a virtual network property. Option C is wrong because the effect is deny, not audit, so noncompliant requests are blocked rather than merely logged. Option D is wrong because the policy scope is the storage account resource itself, not the blob service child resource.

Answer

It denies creation of virtual networks that are not using HTTPS.

Answer

It audits storage accounts to check if HTTPS traffic is enforced.

Answer

It denies creation of blob services that do not enforce HTTPS.

Question 6

A company uses Microsoft Sentinel to detect threats. They want to automatically send an email to the security team when a high-severity incident is created. What should they configure?

Accepted Answer

An analytics rule with an automated response. The correct option is A, an analytics rule with an automated response, because in Microsoft Sentinel analytics rules generate incidents from detected events, and their automated response (via automation rules or playbooks triggered on incident creation) can send an email to the security team when a high-severity incident is created. This directly satisfies the requirement of automatic notification upon incident creation. A workbook (B) is only a visualization/reporting dashboard and does not trigger notifications. A watchlist (C) stores reference data for enrichment or correlation and cannot send emails. A hunting query (D) is a manual, proactive search for threats and does not automatically notify anyone.

Answer

A workbook

Answer

A watchlist

Answer

A hunting query

Question 7

A company uses Azure Front Door to publish a web application globally. They need to protect against DDoS attacks and web application attacks (SQL injection, XSS). Which two services should they enable in combination?

Accepted Answer

Azure DDoS Protection Standard and Azure WAF policy on Front Door. Azure DDoS Protection protects against volumetric DDoS attacks. Azure Web Application Firewall (WAF) in Front Door protects against application-layer attacks. Azure Firewall is for network-layer filtering. Network Security Groups (NSGs) are for subnet-level filtering. Azure DDoS Protection Standard is the correct tier.

Answer

Azure DDoS Protection Standard and Azure Firewall

Answer

Azure WAF on Application Gateway and Network Security Groups

Answer

Azure Firewall and Azure DDoS Protection Basic

Question 8

Your organization is adopting a Zero Trust security model. You need to design a solution that ensures continuous verification of user identity and device health before granting access to resources. Which Microsoft Entra ID feature should you prioritize?

Accepted Answer

Microsoft Entra ID Conditional Access. Conditional Access is the primary Microsoft Entra ID feature that enforces continuous verification by evaluating user identity, device health (via compliance policies or Microsoft Defender for Endpoint signals), location, and risk in real-time before granting access. It directly supports the Zero Trust principle of 'never trust, always verify' by requiring authentication and authorization at every access attempt, not just at the perimeter.

Answer

Microsoft Entra ID Domain Services

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Question 9

You are a security architect for a large financial services company. The company has a hybrid identity environment with on-premises Active Directory synchronized to Microsoft Entra ID using Microsoft Entra Connect. They use Microsoft 365 E5 licenses and have deployed Microsoft Defender for Cloud, Microsoft Defender for Identity, Microsoft Sentinel, and Microsoft Purview. The company has recently suffered a ransomware attack where an attacker gained access via a compromised service account that had permanent Global Administrator privileges. The attacker then used the account to create a backdoor user and exfiltrate sensitive data from SharePoint Online. After the incident, the CISO mandates a Zero Trust security transformation with the following requirements: 
1. Eliminate standing privileged access for all cloud admins.
2. Require phishing-resistant authentication for all privileged roles.
3. Ensure that all sensitive data in SharePoint Online is automatically classified and protected.
4. Enable detection of lateral movement using anomalous behavior analytics. Which combination of actions should you recommend?

Accepted Answer

Implement Privileged Identity Management (PIM) for Global Administrator roles, configure Authentication Strengths to require FIDO2, create auto-labeling policies for credit card numbers, and enable Defender for Identity lateral movement path detection.. It directly addresses all four CISO requirements: Privileged Identity Management (PIM) eliminates standing Global Administrator privileges by requiring just-in-time activation; Authentication Strengths with FIDO2 enforces phishing-resistant authentication for privileged roles; auto-labeling policies in Microsoft Purview automatically classify and protect sensitive data like credit card numbers in SharePoint Online; and Defender for Identity lateral movement path detection uses behavioral analytics to detect anomalous lateral movement, fulfilling the detection requirement.

Answer

Deploy Microsoft Entra Identity Protection for all users, configure Azure AD Conditional Access with MFA, use Microsoft Purview Information Protection with manual labeling, and enable Microsoft Sentinel analytics for lateral movement.

Answer

Configure Conditional Access to require MFA for admins, enable Microsoft Purview DLP for SharePoint, deploy Defender for Cloud Apps, and use Identity Protection for user risk.

Answer

Remove all permanent admin roles and use just-in-time access via PIM, enforce MFA via Conditional Access, apply sensitivity labels via Microsoft Purview Data Map, and use Microsoft Defender for Cloud for network security groups.

Question 10

Your organization uses Microsoft Sentinel and wants to correlate security events from multiple sources to detect multi-stage attacks. What should you create?

Accepted Answer

Fusion rule. Fusion rules in Microsoft Sentinel are specifically designed to correlate security events from multiple sources and detect multi-stage attacks by combining alerts from different detection technologies into a single incident. This matches the requirement to correlate events across sources for complex attack chains, unlike other rule types that focus on single-source or single-event detection.

Answer

Scheduled query rule

Answer

NRT rule

Answer

Anomaly rule

Question 11

A company uses Azure DevOps and wants to implement a DevSecOps practice by scanning code for secrets and vulnerabilities before deployment. Which tool should they integrate into their pipeline?

Accepted Answer

Microsoft Defender for DevOps. Microsoft Defender for DevOps is the correct choice because it is a unified DevSecOps solution that integrates directly into Azure DevOps pipelines to scan code for secrets, vulnerabilities, and open-source dependencies before deployment. It provides actionable security insights and remediation guidance, aligning with the requirement to implement a DevSecOps practice by scanning code for secrets and vulnerabilities.

Answer

Azure Policy

Answer

Microsoft Purview

Answer

GitHub Advanced Security

Question 12

A company is designing a security strategy for their AI-powered applications using Microsoft Azure OpenAI Service. They need to ensure that the AI models are not used to generate harmful content and that the data sent to the models is protected. Which Microsoft Purview feature should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) for AI. Microsoft Purview Data Loss Prevention (DLP) for AI is the correct feature because it is specifically designed to monitor and control the data sent to and from AI applications, including Azure OpenAI Service, to prevent the generation of harmful content and protect sensitive data. It uses deep content analysis and policy-based controls to detect and block policy violations in real-time, directly addressing the dual requirements of content safety and data protection.

Answer

Microsoft Purview Endpoint DLP

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Audit

Question 13

A company uses Azure App Service to host a web application that stores sensitive data in Azure SQL Database. The security team requires that data at rest in the database be encrypted using a customer-managed key stored in Azure Key Vault. The key must be rotated automatically every 90 days. What is the recommended approach to meet these requirements?

Accepted Answer

Enable TDE with customer-managed keys in Azure Key Vault and set a key rotation policy in Key Vault to rotate the key every 90 days.. Transparent Data Encryption (TDE) with customer-managed keys (CMK) in Azure Key Vault meets the requirement for encrypting data at rest in Azure SQL Database using a key controlled by the customer. Azure Key Vault supports automatic key rotation policies that can be set to rotate the key every 90 days, satisfying the rotation requirement without manual intervention or application code changes.

Answer

Encrypt sensitive columns using cell-level encryption with keys stored in Azure Key Vault and rotate keys manually every 90 days.

Answer

Enable Transparent Data Encryption (TDE) with service-managed keys in Azure SQL Database.

Answer

Use Always Encrypted with column master keys stored in Azure Key Vault and configure key rotation in the application code.

Question 14

A company is designing a defense-in-depth strategy for their Azure environment. They want to ensure that if a virtual machine is compromised, the attacker cannot move laterally to other VMs in the same virtual network. Which security control should they prioritize?

Accepted Answer

Implement network segmentation using NSGs and application security groups. Network segmentation using NSGs and application security groups is the correct priority because it directly controls east-west traffic between VMs within the same virtual network. By defining explicit inbound and outbound rules that restrict communication to only necessary ports and protocols (e.g., TCP 443 for HTTPS), an attacker who compromises one VM cannot initiate lateral movement to other VMs, as the NSG will drop unauthorized traffic at the subnet or NIC level.

Answer

Enable Azure DDoS Protection on the virtual network

Answer

Enable multi-factor authentication (MFA) for all admin accounts

Answer

Deploy Azure Bastion for secure remote access

Question 15

Tailwind Traders is a small business that uses Microsoft 365 Business Premium. They have no dedicated IT staff. The owner wants to implement basic security measures to protect against common threats like phishing, ransomware, and unauthorized access. They need a simple, cost-effective solution that aligns with Microsoft's security best practices for small businesses. Which set of actions should you recommend?

Accepted Answer

Enable Security Defaults in Microsoft Entra ID to enforce MFA for all users. Configure Microsoft Defender for Office 365 to protect against phishing and malware. Use Microsoft Defender for Business (included) for endpoint protection. Regularly review the Microsoft 365 Secure Score and implement top recommendations.. It aligns with Microsoft's security best practices for small businesses with no dedicated IT staff. Security Defaults in Microsoft Entra ID provide a baseline of MFA enforcement without requiring complex configuration. Microsoft Defender for Office 365 and Defender for Business (included in Microsoft 365 Business Premium) offer integrated phishing, malware, and endpoint protection. Regularly reviewing the Secure Score ensures continuous improvement against common threats like ransomware and unauthorized access.

Answer

Implement Privileged Identity Management (PIM) for all accounts. Use Azure Information Protection to classify all emails. Set up a SIEM using Microsoft Sentinel.

Answer

Deploy Microsoft Intune to manage devices. Configure Conditional Access policies to require compliant devices. Use Microsoft Defender for Endpoint for antivirus. Set up a VPN for remote access.

Answer

Purchase Azure AD Premium P2 for all users. Use Identity Protection to detect risks. Configure Conditional Access with session controls. Use Azure AD Identity Governance for access reviews.

Question 16

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They want to prevent users from sharing credit card numbers in email but allow sharing via encrypted email. What should they configure?

Accepted Answer

Configure a DLP rule that blocks sharing unless the email is encrypted, with user override. Microsoft Purview DLP can enforce a policy that blocks sharing of credit card numbers unless the email is encrypted, with a user override option to allow legitimate encrypted sharing. This directly meets the requirement to prevent unencrypted sharing while permitting encrypted email transmission, leveraging DLP's ability to inspect email content and conditionally apply actions based on encryption status.

Answer

Assign a sensitivity label that encrypts the email automatically

Answer

Create a Microsoft Purview Message Encryption policy

Answer

Use Exchange mail flow rules to block unencrypted credit card data

Question 17

Your organization is migrating to Microsoft 365 and wants to implement a defense-in-depth strategy for email security. Which combination of Microsoft services should you use?

Accepted Answer

Microsoft Defender for Office 365 and Exchange Online Protection. Defense-in-depth for email security requires layered protection at the transport, filtering, and post-delivery stages. Exchange Online Protection (EOP) provides baseline anti-malware, anti-spam, and transport rules, while Microsoft Defender for Office 365 adds advanced threat protection like Safe Attachments, Safe Links, and anti-phishing policies that inspect URLs and attachments in real time. Together, they cover the full email threat chain from ingress to user interaction.

Answer

Microsoft Purview Compliance Manager and Microsoft Defender for Cloud Apps

Answer

Microsoft Intune and Microsoft Entra ID

Answer

Microsoft Sentinel and Microsoft Defender for Identity

Question 18

Refer to the exhibit. You are analyzing a Microsoft Sentinel analytics rule. What does this rule detect?

Accepted Answer

Brute-force attack against a single account. This rule detects a brute-force attack against a single account by triggering when the number of failed logons for a specific user exceeds a threshold within a given time window, followed by a successful logon. The condition `FailedLogons > 5` and `SuccessfulLogon > 0` for the same account indicates that the attacker has guessed the correct password after multiple failed attempts, which is a classic sign of a successful brute-force attack.

Answer

Multiple successful logons for the same account

Answer

Multiple failed logons from the same source IP address

Answer

Overall number of failed logons across all accounts

Question 19

A company is designing a security operations center (SOC). They want to use Microsoft Sentinel as their SIEM. They need to ensure that all security events from on-premises servers are collected. Which data connector should they configure?

Accepted Answer

Windows Security Events via Azure Monitor Agent (AMA). The Windows Security Events via Azure Monitor Agent (AMA) connector is the recommended method for collecting security events from on-premises Windows servers into Microsoft Sentinel. AMA is the current generation agent that supports data collection rules (DCRs) for granular filtering and is fully supported by Sentinel, replacing the legacy Log Analytics Agent. This ensures comprehensive collection of Windows security logs such as Event ID 4625 (failed logons) and 4688 (process creation) for SOC analysis.

Answer

Windows Firewall via Legacy Agent

Answer

Syslog via AMA

Answer

Azure Activity Log

Question 20

A company uses Azure Policy to audit storage accounts for secure transfer (HTTPS) enforcement. The policy is set to 'AuditIfNotExists' but compliance shows 0% non-compliant storage accounts even though some accounts have secure transfer disabled. What is the most likely cause?

Accepted Answer

The policy should use 'Audit' or 'Deny' effect instead of 'AuditIfNotExists'. The 'AuditIfNotExists' effect is designed to audit resources that do not have a specific extension or sub-resource (e.g., a diagnostic setting or an agent). For a policy that needs to check a property of the storage account itself (like secure transfer enabled), the correct effect is 'Audit' (or 'Deny'). 'AuditIfNotExists' will never flag a storage account as non-compliant for missing the secure transfer property because it is looking for the absence of a child resource, not a property misconfiguration.

Answer

The policy is in 'audit' mode and does not evaluate

Answer

The storage accounts are in a different region

Answer

The policy assignment scope does not include the non-compliant accounts