SC-100 Practice Test 34 — 15 Questions

Question 1

Your organization is designing a solution to protect sensitive data in Microsoft SharePoint Online. You need to ensure that documents containing credit card numbers are automatically encrypted when shared with external users. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An auto-labeling policy for sensitivity labels with encryption. The correct option is C: an auto-labeling policy for sensitivity labels with encryption. In Microsoft Purview, auto-labeling policies scan SharePoint Online content for sensitive information types such as credit card numbers and automatically apply a sensitivity label; when that label is configured with encryption, the document is encrypted and the protection travels with the file even when shared with external users. Option A is wrong because a DLP policy that blocks sharing prevents external sharing rather than encrypting the document, and DLP does not itself apply encryption. Option B is wrong because SharePoint IRM encrypts files at rest in the library and relies on the service to enforce permissions, but it does not automatically classify and encrypt documents based on sensitive content detection. Option D is wrong because a retention policy with a hold only preserves content for compliance and does not encrypt it.

Answer

A Data Loss Prevention (DLP) policy that blocks sharing

Answer

Information Rights Management (IRM) for SharePoint

Answer

A retention policy with a hold

Question 2

You are designing a secure data classification strategy for documents in Microsoft 365. The compliance officer wants to automatically apply a 'Confidential' label to documents containing credit card numbers. Which Microsoft Purview feature should you use?

Accepted Answer

Auto-labeling policies. Auto-labeling policies (option A) are the correct choice because they are the Microsoft Purview feature designed to automatically apply sensitivity labels to content that matches specified conditions, such as documents containing credit card numbers detected via sensitive information types. This directly satisfies the compliance officer's requirement to apply a 'Confidential' label automatically without user intervention. Data loss prevention policies (B) can detect and block or warn about sensitive content but do not apply sensitivity labels. Trainable classifiers (C) can identify content categories by example, but they are used as conditions within labeling or DLP, not as the labeling mechanism itself. Manual labeling (D) requires users to apply labels themselves, which does not meet the automation requirement.

Answer

Data loss prevention policies

Answer

Trainable classifiers

Answer

Manual labeling

Question 3

Refer to the exhibit. You are reviewing a conditional access policy JSON in Microsoft Entra ID. The policy is enabled but users with the Global Administrator role are not being prompted for MFA. What is the most likely reason?

Accepted Answer

The policy does not include any users except by role.. The Conditional Access policy JSON shows that the 'users' object does not include an 'includeUsers' property for all users or specific groups; instead, users are only included by directory role (e.g., through 'includeRoles'). If the 'includeRoles' array is either empty or does not contain the 'Global Administrator' role, then Global Administrators are not targeted by the policy. Therefore, they are not prompted for MFA despite the policy being enabled. This is the most likely reason because the other options are incorrect: the policy may include applications (option B), the grant control could be set to MFA (not requiring compliant device) (option C), and the policy is enabled (option D).

Answer

The policy does not include any applications.

Answer

The grant control requires a compliant device instead of MFA.

Answer

The policy state is disabled.

Question 4

Your organization is using Microsoft Defender for Cloud to secure applications running on Azure. You need to ensure that all Azure Storage accounts have secure transfer required enabled. What is the BEST way to enforce this?

Accepted Answer

Assign an Azure Policy initiative that includes the built-in policy 'Secure transfer to storage accounts should be enabled' with a 'Deny' effect.. The best way to enforce that all Azure Storage accounts have secure transfer required enabled is to assign an Azure Policy initiative that includes the built-in policy 'Secure transfer to storage accounts should be enabled' with a 'Deny' effect (option C). Azure Policy is the native governance service that evaluates resource properties and can block non-compliant deployments, so a Deny effect prevents creation or modification of storage accounts that do not have secure transfer required enabled. A custom recommendation in Defender for Cloud (option A) only provides visibility and alerts; it does not enforce the setting. Azure Blueprints (option B) can orchestrate policy assignments but is not itself the enforcement mechanism, and it is being deprecated in favor of template specs and deployment stacks. Granting the Storage Account Contributor role (option D) relies on manual action and does not guarantee enforcement.

Answer

Create a custom recommendation in Microsoft Defender for Cloud to alert when storage accounts do not have secure transfer required.

Answer

Use Azure Blueprints to apply the setting to all subscriptions.

Answer

Grant the 'Storage Account Contributor' role to a security group that will manually enable the setting.

Question 5

You are designing a solution to protect an Azure App Service web app that authenticates users via Microsoft Entra ID. The app needs to ensure that only users from specific external partner organizations can access it. You do not want to create user objects for each partner user in your tenant. What should you configure?

Accepted Answer

Enable Microsoft Entra B2B collaboration and configure the application to accept tokens from partner tenants.. Option B is correct because Microsoft Entra B2B collaboration lets partner users authenticate with their own organizational credentials and receive tokens from their home tenant, which the app can accept without creating user objects in your tenant. This directly satisfies the requirement to allow only specific external partner organizations while avoiding per-user objects in your directory. Option A is insufficient because IP-range restrictions do not identify or validate partner organizations and can be bypassed or misapplied. Option C contradicts the requirement by creating guest user objects for each external user. Option D is wrong because Azure AD B2C is intended for customer-facing identity scenarios with local or social accounts, not for federating access with specific partner Microsoft Entra tenants.

Answer

Configure a Conditional Access policy that restricts access to partners' IP ranges.

Answer

Create guest user accounts for each external user and assign them to a group.

Answer

Use Azure AD B2C custom policies to allow partner authentication.

Question 6

A company is designing a secure hybrid network architecture. They have an on-premises network connected to Azure via ExpressRoute and a site-to-site VPN as backup. They want to ensure that traffic from Azure to on-premises always uses ExpressRoute when available, but automatically fails over to VPN if ExpressRoute goes down. Which configuration should they implement?

Accepted Answer

Configure BGP on both connections and assign a higher local preference (e.g., 200) to routes learned via ExpressRoute.. BGP local preference is an attribute used to influence outbound traffic from an AS. By assigning a higher local preference (e.g., 200) to routes learned via ExpressRoute, Azure will prefer those routes over VPN routes (which default to local preference 100). This ensures that traffic from Azure to on-premises uses ExpressRoute when available, and automatically fails over to the VPN if the ExpressRoute BGP session drops, as the VPN routes will then be selected.

Answer

Configure the VPN to have a lower BGP weight than ExpressRoute.

Answer

Use both connections in active-active mode with BGP and rely on ECMP.

Answer

Disable BGP on the VPN connection and use static routes with a higher metric for the VPN.

Question 7

Your organization is implementing a secure DevOps pipeline for a critical application. You need to design a solution that scans container images for vulnerabilities before they are deployed to production. Which Azure service should you integrate into the pipeline?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (formerly Azure Security Center) provides integrated vulnerability assessment for container images stored in Azure Container Registry (ACR). When integrated into a DevOps pipeline, Defender for Cloud can scan images on push or on demand, using the Qualys scanner to detect CVEs and generate detailed security reports. This allows the pipeline to block or flag vulnerable images before they reach production, directly addressing the requirement for pre-deployment vulnerability scanning.

Answer

Azure Key Vault

Answer

Azure Policy

Answer

Azure Security Center

Question 8

A company is designing a secure API for a customer-facing application that will handle sensitive personal data. They need to ensure that only authorized client applications can call the API and that the identity of the end-user is verified. Which of the following should they implement?

Accepted Answer

OAuth 2.0 with client credentials and OpenID Connect. OAuth 2.0 with client credentials authenticates the client application, while OpenID Connect (OIDC) adds an identity layer to verify the end-user's identity via ID tokens. This combination ensures both client authorization and user authentication, which are the two requirements. OAuth 2.0 alone handles authorization, and OIDC extends it for authentication.

Answer

HTTP Basic Authentication

Answer

JWT bearer tokens

Answer

API keys

Question 9

A company wants to automate incident response in Microsoft 365 Defender. Which THREE actions can be automated using automated investigation and response (AIR) capabilities? (Choose three.)

Accepted Answer

Block a file hash across the organization.. Microsoft 365 Defender's automated investigation and response (AIR) can automatically block a file hash at the tenant level using threat intelligence and cloud-delivered protection. When a malicious file is detected, AIR can create an indicator to block the hash across all endpoints via Microsoft Defender for Endpoint, preventing further execution.

Answer

Reset a user's password.

Answer

Create a new user account.

Question 10

You are designing a security solution for Azure resources. You need to ensure that any changes to network security groups (NSGs) are automatically logged and sent to a central Log Analytics workspace. Which Azure feature should you use?

Accepted Answer

Diagnostic settings on the Azure Activity Log. Diagnostic settings on the Azure Activity Log capture all control-plane operations, including changes to NSGs (e.g., rule additions or deletions). By configuring a diagnostic setting to stream the Activity Log to a Log Analytics workspace, you ensure that every NSG modification is automatically logged and centralized for monitoring and alerting.

Answer

Azure Policy

Answer

NSG flow logs

Answer

Azure Monitor alerts

Question 11

Your organization is implementing Microsoft Intune for mobile device management. You need to design a solution that ensures corporate data on mobile devices is protected if the device is lost or stolen. Which TWO actions should you configure?

Accepted Answer

Configure a compliance policy that requires device encryption. A compliance policy requiring device encryption ensures that if a device is lost or stolen, the data stored on it is unreadable without the decryption key. Intune compliance policies evaluate encryption status (e.g., BitLocker on Windows, FileVault on macOS, or device encryption on iOS/Android) and mark noncompliant devices for conditional access blocking, preventing unauthorized access to corporate data.

Answer

Enforce a minimum PIN length on devices

Answer

Require app protection policies (MAM) for all apps

Answer

Enable jailbreak detection in a device compliance policy

Question 12

Your organization is required to retain all Microsoft Teams chat messages for 7 years due to regulatory compliance. You need to design a solution that automatically retains and, if needed, e-discovery searches these messages. What should you configure?

Accepted Answer

Microsoft Purview retention policies and eDiscovery. Microsoft Purview retention policies are designed to retain data for a specified period (e.g., 7 years) and can be applied to Microsoft Teams chat messages. eDiscovery (now part of Microsoft Purview eDiscovery) allows authorized users to search, hold, and export retained content for legal or compliance purposes. Together, they meet the regulatory requirement for retention and searchability.

Answer

Microsoft Purview Data Loss Prevention policies

Answer

Azure Policy

Answer

Sensitivity labels auto-labeling

Question 13

Your organization is deploying Microsoft Defender for Cloud to secure a hybrid environment with workloads in Azure and on-premises. You need to ensure that all servers are covered by Defender for Cloud's plans. Which two actions should you take?

Accepted Answer

Install the Azure Connected Machine agent (Azure Arc) on on-premises servers.. The correct actions are A and C. Installing the Azure Connected Machine agent (Azure Arc) on on-premises servers is required to project non-Azure machines into Azure so Defender for Cloud can see and manage them, and enabling the Defender for Cloud plans (e.g., Defender for Servers) on the Azure subscription activates the actual protection plans that cover those servers. Option B is insufficient because foundational CSPM only provides posture assessment and does not enable workload protection plans such as Defender for Servers. Option D is not sufficient by itself because the Azure Monitor Agent collects monitoring data but does not onboard on-premises servers into Defender for Cloud without Azure Arc and the relevant Defender plan.

Answer

Enable only the foundational cloud security posture management (CSPM) on the subscription.

Answer

Deploy the Azure Monitor Agent to all on-premises servers.

Question 14

A large enterprise is designing a secure infrastructure for a multi-region application deployment. They have a hub-spoke topology in two Azure regions (East US and West US) with VNet peering between the hubs. Each region has a shared services spoke containing Azure AD Domain Services (AAD DS) and management jump boxes. Application spokes in each region host VMs that need to authenticate to the local AAD DS. The company mandates that all traffic between regions must traverse a network virtual appliance (NVA) for inspection, except for Azure management traffic. They also require that all outbound internet traffic from application VMs goes through a single Azure Firewall in the East US hub. They have deployed ExpressRoute to on-premises. Currently, application VMs in West US cannot authenticate to the local AAD DS. What is the most likely cause?

Accepted Answer

The route table for the West US application spoke has a default route (0.0.0.0/0) pointing to the NVA, causing traffic to AAD DS to be sent across regions.. The most likely cause is that the route table for the West US application spoke has a default route (0.0.0.0/0) pointing to the NVA. This forces all outbound traffic, including traffic destined for the local AAD DS (which resides in the same region's shared services spoke), to be routed through the NVA and potentially across regions via the hub peering, rather than staying within the local VNet. Since AAD DS requires low-latency, direct connectivity within the same region, this misrouting prevents authentication.

Answer

The Azure Firewall in East US is not configured to allow traffic from West US to AAD DS.

Answer

The VNet peering between East and West US hubs is not properly configured with 'Allow forwarded traffic' enabled.

Answer

The ExpressRoute circuit is down, causing traffic to be routed over the internet.

Question 15

Your organization is adopting Microsoft Copilot for Microsoft 365. You need to ensure that Copilot respects the existing sensitivity labels when processing data. What should you configure?

Accepted Answer

Configure sensitivity labels in Microsoft Purview Information Protection.. The correct option is B: Configure sensitivity labels in Microsoft Purview Information Protection. Copilot for Microsoft 365 honors the sensitivity labels applied to content, so labels must be defined and published through Microsoft Purview Information Protection (the current unified labeling platform) for Copilot to respect classification and protection settings such as encryption and content marking. DLP policies (A) enforce rules on sharing or handling of sensitive data but do not provide the classification metadata Copilot uses to respect sensitivity. Azure Information Protection (C) is the legacy labeling client/service being retired in favor of Purview Information Protection, so it is not the configuration target. Retention labels (D) govern lifecycle and retention, not sensitivity-based protection, so they do not control how Copilot treats sensitive content.

Answer

Create Data Loss Prevention (DLP) policies.

Answer

Use Azure Information Protection.

Answer

Apply retention labels to documents.