SC-100 Practice Test 33 — 15 Questions

Question 1

Your organization is migrating on-premises Active Directory to Microsoft Entra ID. You need to ensure that users can authenticate to on-premises resources using their Entra ID credentials. Which feature should you implement?

Accepted Answer

Password Hash Sync with Microsoft Entra Connect. Option A is correct because Microsoft Entra ID with Password Hash Sync allows users to use the same password for cloud and on-premises resources. Option B is wrong because Pass-through Authentication does not sync passwords. Option C is wrong because Federation requires an on-premises identity provider. Option D is wrong because Microsoft Entra Connect Health monitors synchronization health.

Answer

Active Directory Federation Services (AD FS)

Answer

Microsoft Entra Connect Health

Answer

Pass-through Authentication

Question 2

An organization uses Microsoft Sentinel to monitor their hybrid infrastructure. They need to detect brute-force attacks against their on-premises Windows servers. Which data source should they connect to Sentinel?

Accepted Answer

Windows Security Events via Azure Monitor Agent. Windows Security Events from Event ID 4625 (failed logon) are the primary source for detecting brute-force attacks. Azure Activity Log is for resource management events. DNS events are for DNS queries. Sysmon is for process activity, not logon failures.

Answer

Azure Activity Log

Answer

DNS Events

Answer

Sysmon Events

Question 3

Refer to the exhibit. A security analyst runs the following KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

Detect brute-force attacks against Windows servers. The query filters Windows Security Events for failed logon attempts (EventID 4625) in the last hour, groups by user account, computer, and IP address, and then shows only those with more than 10 failures. This is used to detect brute-force attacks.

Answer

List all accounts that have been locked out

Answer

Identify successful logins from multiple IP addresses

Answer

Find users who logged in after hours

Question 4

Refer to the exhibit. You are reviewing an Azure Policy definition in JSON. What does this policy do?

Accepted Answer

Denies SQL servers from using Azure AD authentication. The policy checks if the SQL server administrator type is 'ActiveDirectory' and denies (deny) if true. This means it blocks the use of Azure AD authentication for SQL servers. Option B is correct. Option A is incorrect because it denies, not allows. Option C is incorrect because it checks the administrator type, not firewall. Option D is incorrect because it does not enforce AD admin; it denies if AD admin is set.

Answer

Allows SQL servers to use Azure AD authentication

Answer

Denies SQL servers that do not have a firewall rule

Answer

Enforces that all SQL servers must have an Azure AD admin

Question 5

Your company plans to deploy Microsoft Defender for Cloud to secure a multi-cloud environment that includes Azure, AWS, and GCP. You need to ensure that security recommendations from all three cloud providers are centrally visible. What should you configure?

Accepted Answer

Onboard AWS and GCP accounts to Microsoft Defender for Cloud using the multicloud connectors feature.. Option B is correct because Microsoft Defender for Cloud can connect AWS and GCP accounts via the multicloud connectors, allowing centralized visibility of security recommendations. Option A is wrong because AWS Security Hub only shows AWS recommendations. Option C is wrong because Azure Policy does not natively assess AWS/GCP resources. Option D is wrong because Microsoft Sentinel is for SIEM/SOAR, not for CSPM recommendations.

Answer

Deploy Azure Policy on AWS and GCP using Azure Arc to enforce security policies.

Answer

Ingest security logs from AWS and GCP into Microsoft Sentinel and use workbooks to view recommendations.

Answer

Connect AWS accounts to AWS Security Hub and GCP accounts to Google Cloud Security Command Center, then view via a single pane of glass.

Question 6

Refer to the exhibit. You are reviewing an Azure Policy definition. What is the effect of this policy?

Accepted Answer

Denies creation of Windows VMs without automatic updates enabled. Option B is correct: The policy denies the creation of virtual machines that do not have automatic updates enabled on Windows. Option A is wrong because the policy applies to all VMs, not just Linux. Option C is wrong because the effect is deny, not audit. Option D is wrong because the condition checks for the absence of the property, not its value being false.

Answer

Denies creation of Windows VMs that have automatic updates enabled

Answer

Audits Windows VMs that have automatic updates disabled

Answer

Audits Linux VMs that have automatic updates enabled

Question 7

A financial services company is designing a secure infrastructure for their Azure SQL Database. They need to encrypt data at rest using customer-managed keys (CMK) stored in a key vault with soft-delete and purge protection enabled. The encryption must be transparent to applications. What should they configure?

Accepted Answer

Transparent Data Encryption (TDE) with Azure Key Vault. Azure SQL Database supports Transparent Data Encryption (TDE) with CMK in Azure Key Vault. Always Encrypted is for column-level encryption. Dynamic Data Masking is for masking, not encryption. Azure Information Protection is for classification.

Answer

Azure Information Protection

Answer

Dynamic Data Masking

Answer

Always Encrypted

Question 8

Your organization has a Microsoft Defender for Cloud Apps policy that detects suspicious OAuth app permissions. You need to ensure that when a high-risk app is detected, the app is automatically disabled and the user is notified. What is the most efficient design?

Accepted Answer

Use the 'Disable app' governance action in the policy, and configure email notification. Option B is correct because it uses the built-in governance action in Defender for Cloud Apps to disable the app and send email. Option A is incomplete as notification alone doesn't disable. Option C is less efficient because it requires additional automation. Option D is incorrect because Incident does not automatically disable the app.

Answer

Configure the policy to notify the user via email

Answer

Send the alert to Microsoft Sentinel and create an incident with a playbook

Answer

Create a Power Automate flow that triggers on the alert to disable the app

Question 9

Which THREE of the following are best practices for securing Azure Kubernetes Service (AKS) clusters? (Choose three.)

Accepted Answer

Enable Azure Policy for AKS to enforce pod security. Option A (enable Azure Policy for AKS), Option C (use managed identities), and Option D (enable network policies) are best practices. Option B is incorrect because RBAC should be enabled, not disabled. Option E is incorrect because secrets should be stored in Azure Key Vault, not in plain text.

Answer

Store secrets in ConfigMaps

Answer

Disable Kubernetes RBAC to simplify management

Question 10

Your organization is deploying Microsoft Intune to manage Windows 11 devices. You need to ensure that devices automatically receive security updates and that users cannot defer updates. Which configuration profile setting should you configure?

Accepted Answer

Create a Windows 10/11 Update Rings policy with a deadline for quality and feature updates.. Option A is correct because the Update rings policy in Intune allows configuring Windows Update settings, including setting deadlines for updates to prevent deferral. Option B is wrong because Compliance policies enforce device compliance but do not control update deferral. Option C is wrong because Device configuration policies are for settings like BitLocker, not update rings. Option D is wrong because Endpoint security policies include antivirus and firewall, not update rings.

Answer

Create a device configuration profile to enable automatic updates.

Answer

Create a compliance policy that requires the device to have the latest updates installed.

Answer

Create an endpoint security policy for Windows Defender Antivirus to enforce update installation.

Question 11

Refer to the exhibit. You are reviewing an ARM template that deploys a storage account. The compliance team requires that all storage accounts use TLS 1.2 or higher. Does this template meet the requirement?

Accepted Answer

Yes, because minimumTlsVersion is set to TLS1_2.. Option A is correct because the template sets minimumTlsVersion to TLS1_2, which meets the requirement. Option B is wrong because the property is set correctly. Option C is wrong because the template uses a valid apiVersion. Option D is wrong because Standard_GRS is not related to TLS version.

Answer

Yes, because Standard_GRS automatically enforces TLS 1.2.

Answer

No, because supportsHttpsTrafficOnly only allows HTTPS but does not enforce TLS 1.2.

Answer

No, because the apiVersion is outdated and does not support TLS setting.

Question 12

You are designing a security solution for an Azure Kubernetes Service (AKS) cluster that runs containerized workloads. The cluster must be integrated with Microsoft Defender for Cloud for threat detection, and you need to ensure that container images are scanned for vulnerabilities before deployment. What should you configure?

Accepted Answer

Enable Azure Defender for Containers in Microsoft Defender for Cloud and integrate with Azure Container Registry for image scanning.. Option A is correct because Azure Defender for Containers provides vulnerability scanning for images in Azure Container Registry and threat detection for AKS. Option B is wrong because Azure Policy only enforces admission controls, not scanning. Option C is wrong because Microsoft Sentinel is for log analysis. Option D is wrong because Microsoft Defender for Cloud Apps is for cloud app security, not container scanning.

Answer

Enable Microsoft Defender for Cloud Apps to discover and assess container vulnerabilities.

Answer

Deploy Azure Policy for Kubernetes with built-in policies to enforce image scanning.

Answer

Configure Microsoft Sentinel to collect container logs and detect vulnerabilities.

Question 13

You are designing a security solution for containers in Azure Kubernetes Service (AKS). The solution must scan container images for vulnerabilities before deployment and enforce runtime security. Which combination of Microsoft Defender for Cloud features should you enable?

Accepted Answer

Microsoft Defender for Containers. Option B is correct because Defender for Containers provides vulnerability assessment for images and runtime threat detection for AKS clusters. Option A is wrong because Defender for Servers is for VMs, not containers. Option C is wrong because Defender for App Service protects web apps, not containers. Option D is wrong because Defender for Cloud's regulatory compliance does not provide vulnerability scanning or runtime protection.

Answer

Microsoft Defender for App Service

Answer

Microsoft Defender for Cloud regulatory compliance dashboard

Answer

Microsoft Defender for Servers

Question 14

Refer to the exhibit. An administrator is reviewing a just-in-time (JIT) access request in Microsoft Entra Privileged Identity Management (PIM) for Azure resources. The request was approved. What does the roleDefinitionId 'b24988ac-6180-42a0-ab88-20f7382dd24c' correspond to?

Accepted Answer

Storage Account Contributor. The roleDefinitionId 'b24988ac-6180-42a0-ab88-20f7382dd24c' is the GUID for the 'Storage Account Contributor' role in Azure RBAC. This is a built-in role that allows management of storage accounts, including access to storage account keys. The request is for temporary access to a storage account, and the role provides the necessary permissions.

Answer

Storage Blob Data Contributor

Answer

Contributor

Answer

Reader

Question 15

Your company plans to use Microsoft Sentinel to detect threats across multiple Azure subscriptions. You need to design a cost-effective solution that ingests logs from all subscriptions. What should you use?

Accepted Answer

Deploy a single Sentinel workspace and configure data collection rules to collect logs from all subscriptions. Option C is correct because a workspace-centric design with data collection rules sends logs from multiple subscriptions to a single workspace, reducing costs. Option A is incorrect because multiple workspaces increase cost. Option B is incorrect because Azure Policy does not centralize ingestion. Option D is incorrect because a hub-spoke network does not solve log ingestion.

Answer

Use Azure Lighthouse to manage cross-subscription connectivity

Answer

Create a separate Sentinel workspace for each subscription

Answer

Use Azure Policy to assign a Log Analytics workspace to each subscription