SC-100 Practice Test 31 — 15 Questions

Question 1

Your company, Fabrikam, is designing a solution to securely store and manage secrets (e.g., API keys, database passwords) for cloud applications. The solution must use Azure Key Vault and support automatic rotation of secrets. The applications will run on Azure VMs and Azure App Service. Which TWO of the following should you include in your design?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement automatic secret rotation using Key Vault with Event Grid and Azure Functions.. Option E is correct because managed identities for Azure resources let Azure VMs and App Service apps authenticate to Key Vault without storing any credentials in code or configuration, which is the recommended, most secure authentication method for this scenario. Option D is correct because Key Vault's secret rotation can be automated by emitting near-expiration events to Event Grid, which triggers an Azure Function to generate and write a new secret version back into Key Vault, satisfying the automatic rotation requirement. Option A is not appropriate because service principals with client secrets require you to store and manage a credential, reintroducing the secret-management problem managed identities solve. Option B is wrong because manual rotation via Azure Automation runbooks is not automatic rotation and adds operational overhead. Option C is wrong because storing secrets in application configuration files, even if encrypted with Key Vault, does not use Key Vault as the secret store and undermines centralized secure storage and rotation.

Answer

Use service principals with client secrets to authenticate to Key Vault.

Answer

Rotate secrets manually using Azure Automation runbooks on a schedule.

Answer

Store secrets in application configuration files encrypted with Azure Key Vault.

Question 2

Which THREE security controls should you implement to protect a web application against common OWASP Top 10 vulnerabilities?

Accepted Answer

Input validation on all user inputs. Input validation on all user inputs (B) is correct because it directly mitigates injection flaws such as SQL injection, command injection, and cross-site scripting (XSS) by rejecting or sanitizing untrusted data before it reaches interpreters or the browser. Content Security Policy (CSP) headers (C) are correct because they restrict which scripts, styles, and other resources the browser may load, providing defense-in-depth against XSS and data injection attacks listed in the OWASP Top 10. A Web Application Firewall (WAF) (D) is correct because it inspects HTTP/HTTPS traffic and blocks common attack patterns like SQLi, XSS, and path traversal, offering a compensating control for vulnerabilities that may not yet be patched in the application. Role-Based Access Control (A) and Multi-factor authentication (E) are valuable identity and access management controls, but they address authentication and authorization concerns rather than the broad set of injection, misconfiguration, and client-side vulnerabilities targeted by the OWASP Top 10, so they are not among the three required controls here.

Answer

Role-Based Access Control (RBAC)

Answer

Multi-factor authentication (MFA)

Question 3

Which THREE of the following are best practices for designing a secure hybrid network architecture with Azure?

Accepted Answer

Use Azure Bastion for secure VM access without public IPs. Option A is correct because Azure Bastion provides RDP/SSH connectivity to VMs directly through the Azure portal over TLS, eliminating the need to expose public IP addresses or open inbound management ports (3389/22) on the VMs, which removes a major attack surface in a hybrid design. Option C is correct because ExpressRoute gives private, dedicated connectivity between on-premises and Azure that bypasses the public internet, and pairing it with Azure Firewall provides centralized, stateful Layer 3–7 traffic inspection and filtering across the hybrid boundary. Option E is correct because forced tunneling routes all internet-bound traffic from Azure subnets back through on-premises (via UDRs with a next hop of the VPN/ExpressRoute gateway), enabling on-premises firewalls, proxies, and DLP to inspect and control that traffic consistently. Option B is wrong because opening all ports to a management subnet violates least-privilege and network segmentation principles, dramatically expanding the attack surface. Option D is wrong because a single VPN gateway is a regional resource and a single point of failure; multi-region designs should use gateways per region (or zone-redundant/active-active configurations) for resiliency and latency.

Answer

Open all ports to a management subnet for ease of administration

Answer

Use a single VPN gateway for all regions

Question 4

You are designing a network security solution for a multi-tier application hosted in Azure. The front-end web tier must be accessible from the internet, but the back-end database tier must only accept traffic from the front-end tier. Which Azure service should you use to enforce this restriction?

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) [CORRECT] are the right choice because they let you write inbound security rules that allow traffic to the database tier only from the front-end tier's subnet or NSG (using source service tags or NSG references), while denying all other inbound traffic including internet sources. NSGs operate at the subnet/NIC level in Azure and are the standard mechanism for micro-segmentation between tiers of an application. Azure Firewall (A) is a centralized, stateful firewall for controlling outbound/inbound traffic at the VNet level, but it is not the typical tool for simple tier-to-tier allow/deny rules and is more costly and complex than needed here. Azure Bastion (C) provides secure RDP/SSH access to VMs via the Azure portal and does not restrict application-tier traffic. Application Gateway (D) is a layer-7 web traffic load balancer and WAF for the front-end web tier, not a mechanism for restricting database-tier access.

Answer

Azure Firewall

Answer

Azure Bastion

Answer

Application Gateway

Question 5

You are designing a security solution for an Azure SQL Database that stores sensitive customer data. The solution must encrypt the database at rest and in transit, and also mask sensitive columns from non-privileged users. Which combination of features should you implement?

Accepted Answer

Transparent Data Encryption (TDE) and Dynamic Data Masking (DDM). Option A is correct because Transparent Data Encryption (TDE) provides encryption at rest for Azure SQL Database by encrypting the database files, and Dynamic Data Masking (DDM) masks sensitive columns from non-privileged users by obfuscating data in query results without changing the stored data. Azure SQL Database also enforces encryption in transit by default via TLS, so TDE plus DDM satisfies the stated requirements. Option B is wrong because Always Encrypted protects data at rest and in use at the client, but it does not by itself mask columns from non-privileged users, and Row-Level Security restricts rows rather than masking columns. Option C is wrong because Always Encrypted does not provide column masking for non-privileged users. Option D is wrong because cell-level encryption and row-level security address encryption and row filtering, not the required column masking.

Answer

Always Encrypted and Row-Level Security

Answer

Always Encrypted and Dynamic Data Masking (DDM)

Answer

Cell-level encryption and row-level security

Question 6

Your organization plans to use Microsoft Defender for Cloud to protect hybrid workloads across Azure and on-premises servers. You need to ensure that security policies are consistently applied and that compliance status is monitored centrally. What should you configure?

Accepted Answer

Create Azure Policy initiatives and assign them to management groups and subscriptions.. The correct option is B: Create Azure Policy initiatives and assign them to management groups and subscriptions. Azure Policy initiatives (policy sets) are the mechanism Microsoft Defender for Cloud uses to evaluate and enforce security controls consistently across Azure and hybrid/Arc-connected servers, and assigning them at management-group scope cascades the same definitions to all child subscriptions so compliance is monitored centrally in Defender for Cloud's regulatory compliance dashboard. Options A and C do not fit because manually applying Azure Security Benchmark recommendations or configuring policies only inside Defender for Cloud lacks the scalable, centrally assigned initiative/scope model needed for consistent enforcement. Option D is wrong because Azure Blueprints is a deprecated orchestration service for packaging role assignments, policies, and templates at subscription scope, not the recommended way to assign policy initiatives to management groups.

Answer

Implement Azure Security Benchmark recommendations manually.

Answer

Configure security policies directly in Microsoft Defender for Cloud.

Answer

Deploy Azure Blueprints to assign policies to management groups.

Question 7

Your organization is using Microsoft Sentinel to collect security logs from multiple sources, including Azure Activity Logs, Office 365 Audit Logs, and on-premises Windows Event Logs. You need to ensure that security incidents are automatically created when a user from a specific IP address attempts to access a sensitive application. You have already configured the data connectors. What should you create?

Accepted Answer

Create an analytics rule that triggers an incident when access from the IP is detected.. The correct option is C: Create an analytics rule that triggers an incident when access from the IP is detected. In Microsoft Sentinel, analytics rules are the built-in mechanism that evaluates ingested log data against detection logic and automatically generates incidents when conditions match, which is exactly what is required to flag access attempts from a specific IP to a sensitive application. A watchlist (option B) can store the IP for reference or enrichment in queries, but by itself it does not create incidents. A workbook (option A) is only a visualization/reporting tool and takes no automated action, and a playbook (option D) is an automation workflow that responds to incidents or alerts but does not itself detect the access or create the incident.

Answer

Create a workbook to visualize the access attempts.

Answer

Create a watchlist containing the IP address and use it in a query.

Answer

Create a playbook that runs when a specific event occurs.

Question 8

Refer to the exhibit. This is a risk alert from Microsoft Entra ID Identity Protection for user jdoe@contoso.com. You are designing an automated response using Microsoft Sentinel. Which condition should you use to trigger a high-severity incident?

Accepted Answer

If the user risk level is 'high'. The correct condition is A: trigger the high-severity incident when the user risk level is 'high'. In Microsoft Entra ID Identity Protection, user risk represents the probability that a given identity has been compromised, and a 'high' user risk is the strongest aggregate signal for an account-level compromise, making it the appropriate trigger for a high-severity Microsoft Sentinel incident. Option B is not the best fit because sign-in risk is scoped to a single authentication attempt rather than the overall user account. Option C is too narrow, since 'leakedCredentials' is only one risk detection type and does not by itself indicate the highest severity. Option D is incorrect because 'medium' user risk is a lower severity than 'high' and would not justify a high-severity incident.

Answer

If the sign-in risk level is 'high'

Answer

If the risk event types include 'leakedCredentials'

Answer

If the user risk level is 'medium'

Question 9

You are a security architect for a large multinational organization that uses Microsoft 365, Azure, and third-party SaaS applications. The organization has recently experienced a breach where an attacker compromised a user account via a phishing email and then used that account to access sensitive data in SharePoint Online and exfiltrate it via email. The security team wants to implement a comprehensive solution that aligns with the Zero Trust principles of 'verify explicitly', 'use least privilege', and 'assume breach'. You need to design a solution that includes identity protection, conditional access, data protection, and continuous monitoring. You have the following requirements: 1. Block phishing attacks in real time. 2. Enforce least privilege access to sensitive data. 3. Detect and respond to anomalous user behavior. 4. Protect data at rest and in transit. 5. Enable automated response to incidents. Which combination of Microsoft security services and configurations should you recommend?

Accepted Answer

Implement Microsoft Defender for Office 365 to block phishing emails. Use Conditional Access policies with session risk to enforce access controls. Deploy Microsoft Purview DLP and sensitivity labels to protect data. Use Microsoft Sentinel with automation rules and playbooks to detect and respond to incidents.. It directly maps to all five requirements: Defender for Office 365 provides real-time anti-phishing protection, Conditional Access with session risk enforces least-privilege and adaptive access, Microsoft Purview DLP and sensitivity labels protect data at rest and in transit, and Microsoft Sentinel with automation rules and playbooks delivers continuous monitoring plus automated incident response. This combination also aligns with Zero Trust by verifying explicitly through risk-based Conditional Access, applying least privilege via DLP and labels, and assuming breach through Sentinel detection and automated response. Option A lacks identity risk detection and phishing blocking, and Azure Sentinel alone does not provide the required automated response without playbooks. Option B omits phishing protection and automated response, and Azure Monitor is not a SIEM/SOAR platform for incident automation. Option D focuses on on-premises identity threats, which does not address the cloud-based phishing and SaaS exfiltration scenario, and Azure Security Center is not the right tool for Microsoft 365 data protection and automated response.

Answer

Implement Microsoft Defender for Cloud Apps to discover and control SaaS apps. Use Conditional Access with app control. Deploy Microsoft Purview Data Lifecycle Management. Use Azure Sentinel for monitoring.

Answer

Implement Microsoft Entra ID Protection to detect and block risky sign-ins. Use Conditional Access policies to require MFA and block legacy authentication. Use Microsoft Purview sensitivity labels to classify data and Azure Monitor to collect logs.

Answer

Implement Microsoft Defender for Identity to detect on-premises threats. Use Conditional Access with device compliance policies. Deploy Microsoft Purview Information Protection. Use Azure Security Center for monitoring.

Question 10

Your company is deploying Microsoft Sentinel to centralize security logs from Azure, on-premises, and other clouds. You need to ensure logs are ingested cost-effectively while maintaining search performance for the last 30 days. What should you configure?

Accepted Answer

Use Log Analytics workspace with 30-day interactive retention and set long-term retention for older data.. Microsoft Sentinel stores ingested data in a Log Analytics workspace, where the interactive retention setting controls how long data remains available for fast KQL queries and analytics rules. Setting 30-day interactive retention satisfies the search-performance requirement for the last 30 days, while configuring long-term retention for older data keeps historical logs at a lower cost. The other options do not fit: Azure Blob Storage with Azure Data Explorer (A) is not Sentinel's native ingestion and query path, Sentinel has no 30-day free tier that then converts to paid (C), and Event Hubs (D) is only an ingestion pipeline, not a retention or query configuration.

Answer

Store logs in Azure Blob Storage and use Azure Data Explorer for queries.

Answer

Use Sentinel's free tier for 30 days and then move to paid tier.

Answer

Ingest logs into Azure Event Hubs and then into Sentinel.

Question 11

Your organization uses Microsoft Purview Information Protection to label sensitive documents. You need to ensure that documents containing personally identifiable information (PII) are automatically labeled when saved in SharePoint Online. What should you configure?

Accepted Answer

Configure an auto-labeling policy for sensitivity labels targeting SharePoint.. The correct answer is C: configure an auto-labeling policy for sensitivity labels targeting SharePoint. Auto-labeling policies in Microsoft Purview Information Protection are the specific mechanism that scans SharePoint Online (and OneDrive/Exchange) content for sensitive information types such as PII and automatically applies a sensitivity label when a match is found, which is exactly the requirement here. Option A is wrong because retention labels govern data lifecycle and retention, not sensitivity classification, and cannot apply sensitivity labels. Option B is incorrect because publishing a sensitivity label only makes it available to users for manual application; it does not by itself auto-apply labels to content. Option D is incorrect because a DLP policy can detect PII and block or warn on sharing, but it does not automatically apply sensitivity labels to documents.

Answer

Create a retention label with auto-labeling rule.

Answer

Publish a sensitivity label with auto-labeling for SharePoint.

Answer

Set up a DLP policy to detect PII and apply a label.

Question 12

Your company plans to use Microsoft Sentinel to manage security incidents. You need to design a solution that reduces alert fatigue by grouping related alerts into incidents. Which feature should you enable?

Accepted Answer

Analytics rule with alert grouping enabled. The correct option is A, an analytics rule with alert grouping enabled, because in Microsoft Sentinel analytics rules can be configured with incident grouping so that related alerts are consolidated into a single incident, directly reducing alert fatigue. Grouping settings let you combine alerts that share entities or occur within a defined timeframe, which is exactly the scenario's requirement. Watchlists (B) are for storing reference data used in queries and detections, not for grouping alerts into incidents. Automation rules (C) and playbooks (D) respond to or orchestrate actions on alerts/incidents but do not themselves group related alerts into incidents.

Answer

Watchlists to filter noisy alerts

Answer

Automation rules that trigger on alert creation

Answer

Playbooks that run on alert creation

Question 13

Your organization uses Microsoft Sentinel. You need to design a solution to detect and automatically respond to a potential brute-force attack against an on-premises application that is published via Azure AD Application Proxy. The solution should block the attacker's IP address in Azure AD Conditional Access for one hour after detecting more than 10 failed login attempts within 5 minutes. What should you implement?

Accepted Answer

Create a Microsoft Sentinel analytics rule that triggers on a KQL query detecting the failed logins, then use a playbook to add the IP to a Conditional Access block list via the Azure AD API.. You can create a Microsoft Sentinel analytics rule with a KQL query that detects more than 10 failed login attempts within 5 minutes. When the rule triggers, it runs a playbook that uses the Microsoft Entra ID API to add the attacker's IP to a Conditional Access block list, blocking further access for one hour. Option A is incorrect because Microsoft Purview DLP policies are for data protection, not authentication blocking. Option C is incorrect because a WAF rate limit blocks at the network layer but does not integrate with Microsoft Entra Conditional Access, and it cannot read authentication logs from Microsoft Entra ID App Proxy. Option D is incorrect because Microsoft Entra ID Protection sign-in risk policies are user-based and cannot block specific IPs or apply custom logic like a 1-hour block.

Answer

Create a Microsoft Purview Data Loss Prevention policy to block the IP address based on the login pattern.

Answer

Deploy a web application firewall (WAF) in front of the application and configure rate limiting to block the IP.

Answer

Configure a Microsoft Entra ID Protection sign-in risk policy to automatically block the user's sign-in after detecting anomalous activity.

Question 14

Your organization uses Microsoft Purview and needs to automatically apply a retention label to all documents containing personally identifiable information (PII) in SharePoint Online. What should you configure?

Accepted Answer

Auto-labeling policy. An auto-labeling policy in Microsoft Purview is the correct choice because it can automatically apply a retention label to SharePoint Online content when items match specified sensitive information types such as PII, without user intervention. Auto-labeling policies are designed specifically for automatic retention label application at scale across locations like SharePoint, OneDrive, and Exchange. A DLP policy is used to detect and prevent sharing or leakage of sensitive data, not to apply retention labels. A service-side sensitivity label applies encryption/marking for sensitivity, not retention, and a trainable classifier identifies content categories but does not by itself apply retention labels.

Answer

Data loss prevention (DLP) policy

Answer

Service-side sensitivity label

Answer

Trainable classifier

Question 15

Your organization is implementing a security baseline for Windows 11 devices using Microsoft Intune. You need to ensure that BitLocker encryption is enabled on all devices and that recovery keys are stored in Microsoft Entra ID. Which policy type should you configure?

Accepted Answer

Endpoint security policy for disk encryption.. The correct option is B, an Endpoint security policy for disk encryption, because in Intune this policy type is purpose-built to configure BitLocker on Windows 11 and includes the setting to back up recovery keys to Microsoft Entra ID (the 'Save BitLocker recovery information to Microsoft Entra ID' option). It directly enforces encryption at the OS volume and manages key escrow to Entra ID, which is exactly the baseline requirement. Option A (administrative templates) can configure some BitLocker settings but is not the dedicated disk-encryption workload and lacks the streamlined recovery-key-to-Entra ID escrow flow. Option C (update rings) only controls Windows quality/feature update deferrals and has nothing to do with encryption. Option D (compliance policy for device encryption) only evaluates and reports whether a device is encrypted; it does not enable BitLocker or store recovery keys.

Answer

Device configuration profile for administrative templates.

Answer

Update rings for Windows 10 and later.

Answer

Compliance policy for device encryption.