SC-100 Practice Test 33 — 15 Questions

Question 1

You are a security architect for a healthcare organization that is adopting Microsoft 365 and Azure. The organization must comply with HIPAA and has the following requirements: - All users must use multi-factor authentication (MFA) when accessing Microsoft 365 from outside the corporate network. - Mobile devices must be managed and must be compliant before accessing email. - Access to Azure virtual machines must be limited to specific admin users and must be audited. - All sensitive data stored in Azure SQL Database must be encrypted at rest and in transit. You have the following technologies: Microsoft Entra ID, Microsoft Intune, Azure SQL Database, Azure Policy, Azure Key Vault, Microsoft Defender for Cloud, and Azure Bastion. Which combination of services and configurations should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Conditional Access policies for MFA, use Intune compliance policies for mobile devices, deploy Azure Bastion for VM access with audit logging, and enable TDE and enforce TLS for Azure SQL Database.. It maps each requirement to the appropriate native service: Conditional Access policies enforce MFA for external Microsoft 365 access, Intune compliance policies gate mobile email access on managed compliant devices, Azure Bastion provides audited RDP/SSH access to Azure VMs limited to specific admins without exposing public IPs, and TDE plus enforced TLS encrypt Azure SQL Database at rest and in transit. The other options miss key controls: A uses Microsoft Entra application proxy (for web apps, not VM RDP/SSH) and Always Encrypted alone doesn't cover at-rest database encryption or transit TLS; B uses PIM (privileged role activation, not MFA enforcement) and Azure VPN Gateway (network connectivity, not audited admin access); D uses Azure Firewall (network filtering, not VM admin access) and Key Vault (key storage, not SQL data encryption).

Answer

Configure Conditional Access to require MFA only for external access, use Intune for mobile device management, deploy Always Encrypted for Azure SQL Database, and use Azure AD Application Proxy for VM access.

Answer

Configure Microsoft Entra PIM for MFA, use Intune for mobile devices, deploy Azure VPN Gateway for VM access, and enable Double Encryption for Azure SQL Database.

Answer

Use Azure AD Identity Protection for MFA, use Microsoft Endpoint Manager for device compliance, deploy Azure Firewall for VM access, and use Azure Key Vault for SQL encryption keys.

Question 2

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft 365. You need to create a DLP policy that detects and blocks sharing of credit card numbers in Exchange Online emails. Which TWO components must you configure?

Accepted Answer

Action to block sharing. Option D is correct because a DLP policy must reference a sensitive information type (SIT) — in this case the built-in 'Credit Card Number' SIT — so Purview can detect the credit card patterns in Exchange Online email content. Option C is correct because detection alone does nothing; the policy rule must define an action such as 'Block' (or restrict access/encrypt) to prevent the credit card data from being shared via email. Option A is incorrect because retention labels govern data lifecycle and retention, not real-time blocking of sensitive data sharing. Option B is incorrect because auto-labeling policies apply sensitivity labels to content and do not enforce DLP blocking actions. Option E is incorrect because trainable classifiers are used for custom content categories (e.g., resumes, contracts), not for detecting standardized numeric patterns like credit card numbers, which are handled by built-in SITs.

Answer

Retention label for financial data

Answer

Auto-labeling policy

Answer

Trainable classifier for credit card numbers

Question 3

A company uses Microsoft Sentinel for SIEM and SOAR. You need to design a solution to detect and automatically respond to ransomware attacks involving mass file encryption on Windows servers. The response must include isolating the compromised server from the network, creating a backup of affected files, and resetting the user account's password. Which automation approach minimizes manual intervention?

Accepted Answer

Set up an automation rule that runs a playbook to isolate the VM, trigger a backup, and reset the user password.. Microsoft Sentinel automation rules can automatically trigger a Logic Apps playbook in response to an incident, and that playbook can orchestrate the full response chain: isolating the compromised VM (e.g., via network security group changes or Microsoft Defender for Endpoint isolation), initiating a backup/snapshot of affected files, and resetting the user's password through Microsoft Graph or Microsoft Entra ID—all with minimal manual intervention. Option A is incomplete because it only creates a snapshot and emails the team, providing no isolation or password reset. Option B only isolates the VM and does not address backup or password reset, and an alert rule alone is not the full SOAR orchestration. Option D is manual and therefore does not minimize intervention.

Answer

Use a Logic Apps playbook to create a VM snapshot and send an email to the security team.

Answer

Create an alert rule that triggers an Azure Automation runbook to isolate the VM.

Answer

Configure a manual incident response plan that includes password reset.

Question 4

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure resources. The compliance team wants to ensure that all storage accounts have secure transfer required enabled. Which action should you take in Defender for Cloud?

Accepted Answer

Implement the 'Secure transfer to storage accounts should be enabled' recommendation. The correct action is to implement the 'Secure transfer to storage accounts should be enabled' recommendation because Microsoft Defender for Cloud provides built-in security recommendations that map to specific controls. This recommendation directly checks whether the 'Secure transfer required' property is enabled on each storage account, and if not, it provides remediation steps to enforce HTTPS-only traffic, which aligns with the compliance team's requirement.

Answer

Configure the regulatory compliance dashboard

Answer

Review the secure score

Answer

Enable the 'Cloud Security Posture Management' plan

Question 5

You are designing a data classification strategy for a Microsoft 365 tenant. You need to automatically classify documents that contain personally identifiable information (PII) and apply a retention label. Which Microsoft Purview feature should you use?

Accepted Answer

Auto-labeling policies. Auto-labeling policies (option A) are the correct choice because they can automatically apply sensitivity or retention labels to documents in Microsoft 365 services such as SharePoint, OneDrive, and Exchange when content matches specified conditions, including sensitive information types like PII. They are designed specifically for automatic classification and labeling at scale, which matches the requirement to classify PII-containing documents and apply a retention label. Trainable classifiers (option B) can identify content based on examples, but they are used to detect custom content types and still require a labeling policy to apply labels, so they are not the primary feature for this scenario. Manual labeling (option C) requires user intervention and does not meet the need for automatic classification. DLP policies (option D) can detect and protect sensitive information, but they do not apply retention labels; they enforce actions like blocking or notifying.

Answer

Trainable classifiers

Answer

Manual labeling

Answer

Data Loss Prevention (DLP) policies

Question 6

Your organization uses Microsoft Sentinel to centralize security events. You need to ensure that alerts from Microsoft Defender for Cloud are automatically ingested into Sentinel. Which data connector should you enable?

Accepted Answer

Microsoft Defender for Cloud connector. The Microsoft Defender for Cloud connector (formerly Azure Security Center) is specifically designed to ingest alerts and recommendations from Defender for Cloud into Sentinel. The other options are unrelated: Office 365 connector ingests Office logs, Azure Activity logs track Azure resource operations, and DNS connector ingests DNS queries.

Answer

DNS connector

Answer

Office 365 connector

Answer

Azure Activity connector

Question 7

Which THREE of the following are valid ways to protect sensitive data in Microsoft 365 using Microsoft Purview? (Choose three.)

Accepted Answer

Sensitivity labels. Sensitivity labels (A) are a core Microsoft Purview capability that let you classify and encrypt content with protection settings (e.g., encryption, content marking, and access restrictions) that travel with the data across Microsoft 365 workloads. Data Loss Prevention policies (B) in Microsoft Purview detect and block risky sharing of sensitive information (e.g., credit card or PII patterns) in Exchange Online, SharePoint, OneDrive, Teams, and endpoint locations, directly protecting data from exfiltration. Data Lifecycle Management retention policies (C) are also part of Microsoft Purview and protect sensitive data by retaining it for required periods and deleting it when no longer needed, reducing exposure and supporting compliance obligations. Conditional Access (D) is a Microsoft Entra ID feature that governs sign-in and access conditions, not a Purview data-protection control, and Defender for Endpoint (E) is an endpoint security product rather than a Microsoft Purview data protection mechanism.

Answer

Conditional Access policies

Answer

Microsoft Defender for Endpoint

Question 8

Which TWO Microsoft security solutions should be integrated to provide a comprehensive Zero Trust architecture that includes identity protection, endpoint detection, and response? (Select exactly two correct options.)

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (B) is correct because it is the extended detection and response platform that unifies signals across endpoints (Defender for Endpoint), identities (Defender for Identity), email and collaboration (Defender for Office 365), and cloud apps (Defender for Cloud Apps), delivering automated endpoint detection and response capabilities required by the scenario. Microsoft Entra ID (C) is correct because it provides the identity protection pillar of Zero Trust, including Conditional Access, risk-based sign-in and user risk detection via Entra ID Protection, and phishing-resistant authentication such as FIDO2 and Windows Hello for Business. Together, Entra ID secures and verifies identities while Defender XDR detects, investigates, and responds to threats across endpoints and other workloads, satisfying the identity protection plus endpoint detection and response requirement. Microsoft 365 E5 (A) is a licensing bundle rather than a distinct security solution, so it does not itself constitute the integration of identity protection and XDR. Microsoft Sentinel (D) is a SIEM/SOAR platform for centralized log ingestion and orchestration, not the endpoint detection and response engine, and Microsoft Purview (E) focuses on data governance, compliance, and information protection rather than identity or endpoint threat response.

Answer

Microsoft 365 E5

Answer

Microsoft Sentinel

Answer

Microsoft Purview

Question 9

Your organization uses Microsoft Purview Information Protection to label sensitive emails. You need to ensure that labels are applied automatically based on content. Which THREE methods can you use?

Accepted Answer

Sensitive information types. Sensitive information types (C) are predefined or custom patterns that detect sensitive data such as credit card numbers or social security numbers, enabling automatic label application. Auto-labeling policies in Microsoft Purview (D) apply labels automatically to emails and files based on conditions like sensitive information types or trainable classifiers. Trainable classifiers (E) use machine learning to identify content patterns and automatically apply labels without requiring explicit pattern definitions.

Answer

Manual labeling by users

Answer

File plan (for records management)

Question 10

Your organization uses Microsoft Purview to protect sensitive data. You need to create a sensitivity label that automatically encrypts documents containing credit card numbers when they are shared externally. Which configuration should you use?

Accepted Answer

Create an auto-labeling policy that applies a label with encryption for external sharing. Auto-labeling in Purview can be configured to apply a sensitivity label based on sensitive info types like credit card numbers. The label should have encryption enabled for external sharing. The other options describe different scenarios: manual labeling, default labeling, or classification without encryption.

Answer

Create a trainable classifier to detect credit cards

Answer

Create a default label policy for SharePoint

Answer

Create a manual sensitivity label that users apply

Question 11

Which TWO actions align with the Zero Trust principle of 'verify explicitly'? (Select two.)

Accepted Answer

Use conditional access policies to evaluate user and device risk before granting access. Option B is correct because conditional access policies in Microsoft Entra ID evaluate signals such as user risk, sign-in risk, device compliance, and location at the moment of each access request, which is the essence of 'verify explicitly' — authenticating and authorizing based on all available contextual signals rather than a one-time check. Option D is correct because requiring multifactor authentication for all users forces verification of identity through multiple independent credential factors (something you know plus something you have or are), directly implementing the 'verify explicitly' tenet instead of trusting a single password. The unmarked options do not belong: A (VPN for remote access) primarily establishes a secure tunnel and perimeter-style access, which is more aligned with network-based trust than explicit per-request verification; C (encrypting data at rest) supports the 'assume breach' tenet by protecting data confidentiality, not identity verification; and E (network segmentation) limits lateral movement, which also maps to 'assume breach' rather than 'verify explicitly'.

Answer

Deploy a VPN for remote access

Answer

Encrypt all data at rest

Answer

Implement network segmentation to limit lateral movement

Question 12

You are designing a security solution for containers running on Azure Kubernetes Service (AKS). The requirements include: scanning container images for vulnerabilities, enforcing runtime security, and generating alerts for suspicious activities. Which combination of services should you use?

Accepted Answer

Microsoft Defender for Cloud with Defender for Containers plan. Microsoft Defender for Cloud with the Defender for Containers plan (option D) is correct because it is the purpose-built Azure solution that provides image vulnerability scanning (via the integrated Qualys/registry scanner), runtime threat detection using the Defender sensor on AKS nodes, and security alerts for suspicious container activity in a single integrated service. It also supports Kubernetes-native hardening recommendations and integrates with AKS and Azure Container Registry out of the box. Option A is incomplete because Azure Security Center is the former name of Defender for Cloud and Azure Policy alone only enforces governance, not runtime detection or image scanning. Option B does not fit because Azure Container Registry only stores images and Azure Monitor provides telemetry, not vulnerability scanning or container threat alerts. Option C is incorrect because Azure Policy and Azure Firewall address compliance and network filtering, not image scanning or runtime container security.

Answer

Azure Security Center and Azure Policy

Answer

Azure Container Registry and Azure Monitor

Answer

Azure Policy and Azure Firewall

Question 13

Your organization is deploying Microsoft Intune to manage Windows 11 devices. You need to ensure that devices automatically receive security updates and that users cannot defer updates. Which configuration profile setting should you configure?

Accepted Answer

Create a Windows 10/11 Update Rings policy with a deadline for quality and feature updates.. The correct option is B: a Windows 10/11 Update Rings policy with a deadline for quality and feature updates. Update Rings in Intune are the purpose-built mechanism for controlling Windows Update behavior on managed devices, and configuring a deadline forces installation of quality and feature updates by a set time, preventing users from deferring them indefinitely. Option A is too vague and device configuration profiles do not provide the update-ring deadline enforcement needed here. Option C only evaluates and reports compliance; it does not install updates or block deferrals. Option D concerns Defender Antivirus security settings, not Windows Update ring scheduling or deadlines.

Answer

Create a device configuration profile to enable automatic updates.

Answer

Create a compliance policy that requires the device to have the latest updates installed.

Answer

Create an endpoint security policy for Windows Defender Antivirus to enforce update installation.

Question 14

You are designing a secure remote access solution for employees using Windows 10/11 devices that are managed by Microsoft Intune. The solution must enforce device compliance before allowing access to corporate resources and must support single sign-on (SSO). Which technology should you use?

Accepted Answer

Use Microsoft Entra ID with Conditional Access policies that require compliant devices.. The correct option is D: Microsoft Entra ID with Conditional Access policies that require compliant devices. Conditional Access is the policy engine that evaluates signals such as Intune device compliance status and enforces access decisions to corporate resources, while Entra ID provides the identity platform that enables single sign-on (SSO) across integrated applications. This directly satisfies both requirements: compliance-gated access and SSO for managed Windows 10/11 devices. Option A (traditional VPN with certificate-based authentication) can restrict access but does not natively evaluate Intune compliance or deliver SSO to cloud apps. Option B (Microsoft Entra application proxy) publishes on-premises web apps for remote access but is not a compliance enforcement or SSO mechanism by itself. Option C (Microsoft Defender for Endpoint) is an endpoint detection and response service and does not act as the access-control gate for corporate resources.

Answer

Deploy a traditional VPN with certificate-based authentication.

Answer

Set up Azure AD Application Proxy for remote access.

Answer

Implement Microsoft Defender for Endpoint to block non-compliant devices.

Question 15

You are designing a data classification strategy for Microsoft Purview. The compliance team requires that documents containing personally identifiable information (PII) like credit card numbers are automatically labeled and encrypted when stored in Microsoft SharePoint Online. The solution must use built-in sensitive information types. What should you include in the design?

Accepted Answer

Create a sensitivity label with auto-labeling for credit card numbers and enable encryption. Option A is correct because Microsoft Purview sensitivity labels support auto-labeling policies that can use built-in sensitive information types (SITs) such as Credit Card Number, and the label itself can enforce encryption via the label's encryption settings when applied to documents in SharePoint Online. This directly satisfies the requirement to automatically label and encrypt PII-containing documents using built-in SITs. Option B is incorrect because retention labels govern retention/deletion, not encryption, and DLP policies do not apply retention labels. Option C is incorrect because trainable classifiers are for custom content patterns, not built-in PII SITs like credit card numbers. Option D is incorrect because manual labeling does not meet the automatic labeling requirement.

Answer

Create a retention label and apply it automatically via a data loss prevention (DLP) policy

Answer

Use a trainable classifier to detect PII and apply a sensitivity label

Answer

Configure a manual sensitivity label policy for users to apply