SC-100 Practice Test 32 — 15 Questions

Question 1

Your organization has a Microsoft 365 E5 subscription and uses Microsoft Entra ID for identity. You need to implement a solution to secure privileged access to Azure resources, requiring just-in-time access and approval workflows. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM). Microsoft Entra Privileged Identity Management (PIM) is the correct choice because it provides just-in-time privileged role activation, time-bound assignments, and approval workflows for Azure resources and Entra ID roles, which directly matches the requirement. PIM also supports access reviews, MFA enforcement on activation, and audit trails for privileged access. Microsoft Defender for Identity is a threat detection service for identity-based attacks, not a JIT access or approval mechanism. Microsoft Entra ID administrative units are used to scope administrative permissions to subsets of users or groups, not to provide just-in-time activation or approvals. Microsoft Entra Conditional Access enforces access policies based on conditions such as user, device, and location, but it does not provide JIT role activation or approval workflows.

Answer

Microsoft Defender for Identity

Answer

Azure AD administrative units

Answer

Microsoft Entra Conditional Access

Question 2

Your organization is implementing a defense-in-depth strategy for a multi-tier application hosted on Azure. You need to secure the network layers. Which THREE measures should you implement?

Accepted Answer

Enable Azure DDoS Protection on the virtual network.. Azure DDoS Protection (A) is correct because it defends the virtual network against volumetric and protocol-layer attacks targeting the network/infrastructure layer, which is a core component of defense-in-depth for a multi-tier Azure application. Azure Firewall (C) is correct because it provides stateful traffic inspection, filtering, and centralized policy enforcement (FQDN, network, and application rules) between tiers and to/from the internet, adding a managed network-layer control. Network security groups (E) are correct because NSGs enforce Layer 3/Layer 4 allow/deny rules on subnets and NICs, segmenting traffic between the application's tiers (for example, allowing only the web tier to reach the app tier on specific ports). Azure Front Door (B) is not selected because it is a Layer 7 web application firewall/CDN service, so it addresses the application layer rather than the network layers this scenario asks to secure. A site-to-site VPN gateway (D) is not selected because it provides encrypted connectivity between on-premises networks and Azure, which is a hybrid connectivity measure, not a network-layer security control for the multi-tier application.

Answer

Configure Azure Front Door to protect the application layer.

Answer

Deploy a site-to-site VPN gateway.

Question 3

Your organization uses Microsoft Intune and Microsoft Defender for Endpoint. You need to design a solution that automatically remediates non-compliant devices by running a remediation script. Which Intune component should you use?

Accepted Answer

Remediation policy in Microsoft Intune. The correct option is A, a Remediation policy in Microsoft Intune, because this feature is specifically designed to detect and automatically fix non-compliant devices by running remediation scripts (PowerShell) on them, either on a schedule or when a compliance issue is detected. It pairs with compliance policies to evaluate device state and then executes the script to bring the device back into compliance. Device compliance policies (B) only define and evaluate compliance rules and mark devices compliant or non-compliant; they do not run scripts to remediate. App protection policies (C) protect app data on mobile devices and do not remediate device compliance. Device configuration profiles (D) push settings to devices but do not provide detection-and-remediation script logic.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration profile

Question 4

Your company is deploying Microsoft Defender XDR. You need to design a solution that uses advanced hunting to proactively search for threats. Which THREE data sources should be included in the advanced hunting schema to enable comprehensive threat hunting across endpoints, identities, and cloud apps?

Accepted Answer

CloudAppEvents. CloudAppEvents (C) is correct because it is the Microsoft Defender for Cloud Apps table in the advanced hunting schema, providing audit and activity events from cloud applications (including Office 365 and other connected apps) needed to hunt for threats in the cloud-app pillar. IdentityInfo (D) is correct because it is the Microsoft Defender for Identity table that supplies identity and account metadata (such as account details, group memberships, and directory context) used to investigate and hunt identity-based attacks. DeviceEvents (E) is correct because it is the Microsoft Defender for Endpoint table containing endpoint event telemetry (such as process, file, registry, and network-related events) that enables hunting across the endpoint pillar. EmailEvents (A) is not among the marked answers because, while it is a valid advanced hunting table for email threats, it is not one of the three sources selected to cover endpoints, identities, and cloud apps in this scenario. AzureActivity (B) is not marked correct because it is an Azure control-plane activity log table rather than a core Defender XDR endpoint, identity, or cloud-app hunting source for this design.

Answer

EmailEvents

Answer

AzureActivity

Question 5

Your organization uses Microsoft Purview to govern sensitive data. You need to design a solution that automatically detects and protects credit card numbers in emails and documents stored in Microsoft 365. The solution should also provide data loss prevention (DLP) policy tips to users when they try to share such data externally. What should you configure?

Accepted Answer

Microsoft Purview Data Loss Prevention policies. Microsoft Purview Data Loss Prevention policies (option B) are the correct choice because DLP is the service that detects sensitive information types such as credit card numbers in Exchange Online email and SharePoint/OneDrive documents, and it can enforce protection by blocking or restricting external sharing while displaying policy tips to users in supported apps like Outlook and Office. DLP policies natively support the credit card number sensitive information type and the policy tip configuration for user notifications during external sharing attempts. Sensitivity labels with auto-classification (A) apply classification and protection to content but do not provide DLP policy tips or block external sharing in real time. The Microsoft 365 compliance center (C) is just the administrative portal, not a protection mechanism, and Microsoft Information Protection unified labeling (D) is the labeling infrastructure, not the DLP enforcement engine.

Answer

Sensitivity labels with auto-classification

Answer

Microsoft 365 compliance center

Answer

Microsoft Information Protection unified labeling

Question 6

You are designing a secure infrastructure for an e-commerce platform hosted on Azure. The platform must meet PCI DSS compliance. Which Azure service should you use to centrally manage and monitor security policies across subscriptions?

Accepted Answer

Azure Policy. Azure Policy is the correct choice because it is the Azure service designed to centrally create, assign, and manage policy definitions that enforce and audit security and compliance rules across subscriptions, which directly supports PCI DSS governance at scale. It evaluates resources against built-in or custom policies and reports compliance state, making it suitable for monitoring policy adherence across multiple subscriptions. Azure Firewall (B) is a network security service that filters traffic but does not manage or monitor security policies across subscriptions. Microsoft Defender for Cloud (C) provides security posture management and threat protection, but it is not the primary mechanism for centrally defining and enforcing policy rules across subscriptions. Azure Blueprints (D) is used to package and deploy governed environments with artifacts like policies and role assignments, but it is not the central ongoing policy management and monitoring service.

Answer

Azure Firewall

Answer

Microsoft Defender for Cloud

Answer

Azure Blueprints

Question 7

Which THREE of the following are best practices for securing Azure Kubernetes Service (AKS) clusters? (Choose three.)

Accepted Answer

Enable Azure Policy for AKS to enforce pod security. Option A is correct because Azure Policy for AKS (via the Azure Policy add-on for Kubernetes) enforces pod security standards and organizational guardrails at admission time, preventing non-compliant workloads from being deployed. Option B is correct because managed identities (including workload identity / Microsoft Entra ID pod identity) let pods authenticate to Azure resources without embedding credentials in code or config, eliminating secret sprawl and credential leakage. Option D is correct because Kubernetes NetworkPolicies enforce pod-level segmentation, restricting east-west traffic so a compromised pod cannot freely reach other workloads. Option C is wrong because ConfigMaps store data in plaintext and are not designed for sensitive values; secrets should go in Kubernetes Secrets backed by Azure Key Vault (or the Secrets Store CSI driver). Option E is wrong because disabling Kubernetes RBAC removes least-privilege access control and weakens, rather than strengthens, cluster security.

Answer

Store secrets in ConfigMaps

Answer

Disable Kubernetes RBAC to simplify management

Question 8

Your organization, Fabrikam Inc., uses Microsoft Intune for device management and Microsoft Entra ID for identity. You need to design a solution to ensure that only compliant and healthy devices can access corporate resources. The solution must require that devices are either enrolled in Intune and compliant, or joined to Azure AD with a health attestation. Additionally, you need to block access from devices that are rooted or jailbroken. You have the following requirements: 1) Enforce conditional access policies to check device compliance and health. 2) Use Microsoft Defender for Endpoint integration for device health signals. 3) Provide a fallback option for unmanaged devices to access only web apps via browser with app protection policies. Which combination of actions should you take?

Accepted Answer

Configure conditional access policies: one requiring device compliance or Azure AD joined with health attestation, and another for unmanaged devices requiring app protection policies.. It directly implements the stated requirements: a conditional access policy that grants access only when the device is Intune-enrolled and compliant or Microsoft Entra ID joined with health attestation, plus a separate policy that allows unmanaged devices to reach only web apps when app protection policies (and thus browser-based access with Intune app protection) are applied. This layered approach also supports blocking rooted or jailbroken devices, since compliance and health attestation signals from Intune and Microsoft Defender for Endpoint integration surface device health and tamper state. Option A does not enforce compliance or health, only MFA, and excluding non-compliant devices via filters would not grant the required compliant-device access path. Option B is incomplete because it omits the fallback policy for unmanaged devices and does not explicitly cover the Microsoft Entra ID joined with health attestation alternative. Option C blocks unknown locations and forces enrollment for everyone, which contradicts the requirement to allow unmanaged devices limited browser access to web apps.

Answer

Configure conditional access to require MFA for all devices, and use device filters to exclude non-compliant devices.

Answer

Configure conditional access to require device compliance, and enable device health attestation via Intune.

Answer

Configure conditional access to block access from unknown locations, and require device enrollment for all users.

Question 9

Your organization needs to comply with GDPR. You need to design a data protection strategy using Microsoft Purview. Which THREE capabilities should you include?

Accepted Answer

Data classification and labeling. Data classification and labeling (C) is essential because Microsoft Purview sensitivity labels and trainable classifiers identify and tag personal data, which is the foundation for applying GDPR-mandated protections. Data subject request management (D) directly supports GDPR data subject rights (access, erasure, portability) by using Purview's Data Subject Request case tooling to find and act on personal data across Microsoft 365. Data Loss Prevention policies (E) enforce GDPR's protection and breach-prevention requirements by detecting sensitive information types (such as EU identifiers) and blocking or auditing their improper sharing. Azure Policy (A) governs Azure resource compliance, not the discovery, classification, or protection of personal data in Purview, and eDiscovery (B) is a legal-hold and investigation tool rather than a GDPR data protection control, so neither belongs in this strategy.

Answer

Azure Policy

Answer

eDiscovery

Question 10

Your organization uses Microsoft Sentinel. You need to design a solution that automatically responds to a detected ransomware incident by isolating the affected device in Microsoft Defender for Endpoint. Which tool should you use to create the automated response?

Accepted Answer

Create a playbook in Microsoft Sentinel using Azure Logic Apps.. The correct option is B: create a playbook in Microsoft Sentinel using Azure Logic Apps. Playbooks are built on Azure Logic Apps and are the mechanism in Microsoft Sentinel for orchestrating automated response actions, including calling the Microsoft Defender for Endpoint connector to run the 'Isolate machine' action against an affected device. Automation rules (option C) can trigger playbooks and perform basic triage, but they do not themselves contain the multi-step response logic that isolates a device. A workbook (option A) is only a visualization/reporting tool, and a hunting query (option D) is a proactive search for threats, neither of which performs automated remediation.

Answer

Create a workbook in Microsoft Sentinel.

Answer

Create an automation rule in Microsoft Sentinel.

Answer

Create a hunting query in Microsoft Sentinel.

Question 11

You are reviewing an ARM template snippet that creates a blob container. The security team requires that the container be accessible only via authorized Azure AD identities, not via anonymous access. Based on the exhibit, is the configuration correct?

Accepted Answer

Yes, the setting 'publicAccess': 'None' prevents anonymous access, and Azure AD authentication is available by default. Option C is correct because setting 'publicAccess' to 'None' on a blob container disables anonymous read access, and Microsoft Entra ID (Microsoft Entra ID) authorization is always available for Blob Storage data-plane operations when a caller presents a valid OAuth 2.0 token with the appropriate RBAC role. No additional template property is required to enable Microsoft Entra ID authentication; it is a service-level capability. Option A is wrong because disabling shared key access is an optional hardening step, not a prerequisite for Microsoft Entra ID-only access. Option B is wrong because 'Blob' or 'Container' publicAccess values actually permit anonymous read access, the opposite of the requirement. Option D is wrong because firewall rules restrict network origin, not the authentication method, and are not required to enforce Microsoft Entra ID authorization.

Answer

Yes, but you also need to disable shared key access

Answer

No, you need to set 'publicAccess' to 'Blob' to restrict access

Answer

No, you must also configure a firewall rule to restrict access to Azure AD users

Question 12

Refer to the exhibit. A security analyst is reviewing a Windows security event log from a domain controller. The event indicates an attempted logon failure. Which type of attack is most likely being attempted?

Accepted Answer

Brute-force password guessing attack. A brute-force password guessing attack, because a logon failure event on a domain controller most directly indicates repeated or attempted authentication with incorrect credentials, which is the signature of password guessing. Brute-force attacks generate failed logon events (e.g., Windows Security Event ID 4625) as the attacker tries multiple passwords against an account. In contrast, a Kerberos golden ticket attack (A) forges a TGT using the KRBTGT hash and typically does not produce logon failures, and a DCSync attack (B) abuses directory replication permissions to extract password hashes, not to guess passwords. A pass-the-hash attack (C) authenticates using a stolen NTLM hash and usually succeeds without failed logon attempts, so it does not match the failed-logon scenario.

Answer

Kerberos golden ticket attack

Answer

DCSync attack

Answer

Pass-the-hash attack

Question 13

You need to design a backup and disaster recovery solution for Azure virtual machines that meets a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 1 hour. Which Azure service should you use?

Accepted Answer

Azure Site Recovery. Azure Site Recovery is the correct choice because it provides continuous replication of Azure VMs to a secondary region with recovery points as often as every 5 minutes, easily meeting the 1-hour RPO, and supports orchestrated failover that can bring workloads online within the 15-minute RTO. Azure Backup (D) is designed for data protection and long-term retention, with typical RPOs of once or twice per day and restore times that generally exceed 15 minutes, so it cannot meet these objectives. Azure managed disk (B) is only a storage abstraction and provides no replication or failover capability, while Azure VM snapshots (C) are point-in-time copies with no automated orchestration or cross-region recovery, so neither satisfies the RTO/RPO requirements.

Answer

Azure managed disk

Answer

Azure VM snapshot

Answer

Azure Backup

Question 14

A company is designing a Zero Trust architecture for their hybrid identity environment. They plan to require multifactor authentication (MFA) for all users accessing sensitive applications. Which Microsoft Entra ID capability should they use to enforce MFA based on risk level?

Accepted Answer

Conditional Access. Conditional Access is the correct choice because it is the Microsoft Entra ID policy engine that evaluates signals such as user, device, location, and sign-in risk, and can then require MFA for access to sensitive applications. In a Zero Trust hybrid identity design, Conditional Access policies are where you enforce MFA based on risk level, including integration with risk detections from Microsoft Entra ID Protection. Self-service password reset only lets users reset or unlock their own accounts and does not enforce MFA for application access. Privileged Identity Management governs just-in-time role activation and approvals for privileged roles, not general MFA enforcement for sensitive apps. Microsoft Entra ID Protection detects and reports risk but does not itself enforce the MFA requirement; that enforcement is done through Conditional Access.

Answer

Self-service password reset

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra ID Protection

Question 15

You need to design a secure solution for a web application that authenticates users via Microsoft Entra ID and calls a downstream API. Which TWO should you implement to secure the application? (Choose TWO.)

Accepted Answer

Use the OAuth 2.0 authorization code flow with PKCE.. Option A is correct because the OAuth 2.0 authorization code flow with PKCE is the recommended pattern for interactive web applications that sign users in through Microsoft Entra ID and then call a downstream API on the user's behalf; PKCE protects the authorization code exchange against interception, and the resulting access token is presented to the API. Option B is correct because confidential client applications still need credentials (client secrets or certificates), and Azure Key Vault provides centralized, access-controlled, audited storage for those secrets instead of leaving them in code or config. Option C is wrong because storing secrets in app configuration files exposes them to anyone with file or repository access and is not a secure secret-management practice. Option D is wrong for this scenario because the client credentials flow is a daemon/app-only flow with no user context, so it cannot authenticate interactive users. Option E is wrong because shared access signatures are an Azure Storage authorization mechanism, not an authentication protocol for a Microsoft Entra ID-protected web API.

Answer

Store application secrets in app configuration files.

Answer

Use the OAuth 2.0 client credentials flow.

Answer

Use shared access signatures (SAS) for API authentication.