SC-100 Practice Test 35 — 15 Questions

Question 1

Refer to the exhibit. You are evaluating a custom Azure Policy definition for storage accounts. The policy is assigned with effect set to 'Deny'. An administrator attempts to create a new storage account with network rules configured to allow all traffic (defaultAction set to Allow). What will happen?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The storage account creation is denied.. The correct answer is A: the storage account creation is denied. Because the Azure Policy definition is assigned with the effect set to 'Deny', Azure Policy evaluates the resource request before deployment and blocks any storage account whose network rules use defaultAction set to Allow, so the create operation fails with a policy violation. Deny is a preventive enforcement effect, not a remediation or audit effect, so it stops the request rather than modifying the resource. Option B is wrong because Azure Policy does not automatically rewrite network rules to deny all traffic, and option C is wrong because audit events are produced by the Audit effect, not Deny. Option D is wrong because Deny actively blocks the noncompliant creation instead of allowing it with no action.

Answer

The storage account is created, and the network rules are automatically changed to deny all traffic.

Answer

The storage account is created, and an audit event is generated.

Answer

The storage account is created successfully, and no action is taken.

Question 2

You are designing a network security strategy for a multicloud environment that includes Azure and Amazon Web Services (AWS). The company requires that all traffic between the two clouds be encrypted and inspected for threats. You need to recommend a solution that meets the following requirements: - Minimize latency. - Use Microsoft-provided security services where possible. - Ensure traffic is inspected at Layers 3-7. Which TWO options should you include in your design?

Accepted Answer

Azure Virtual WAN with a secured hub that includes Azure Firewall and Firewall Manager.. Azure Virtual WAN with a secured hub integrates Azure Firewall and Firewall Manager to provide a centralized, Microsoft-managed inspection point for traffic between Azure and AWS. This design minimizes latency by routing inter-cloud traffic through Microsoft's global backbone rather than over the public internet, and it supports Layer 3-7 inspection via Azure Firewall's application and network rules. Similarly, on the AWS side, AWS Transit Gateway with AWS Network Firewall provides a centralized, managed inspection point for traffic between VPCs and other connected networks, including inter-cloud traffic. It also minimizes latency by routing traffic through AWS's global infrastructure and supports Layer 3-7 inspection. Together, these two components satisfy all requirements: encrypted and inspected traffic between the two clouds, minimized latency, use of Microsoft-provided services where possible (Azure Firewall), and Layers 3-7 inspection on both sides.

Answer

Azure Firewall with forced tunneling to an on-premises inspection appliance.

Answer

Azure Policy with built-in network security policies.

Answer

Azure Front Door Premium with Web Application Firewall (WAF) policy.

Question 3

Your company uses Microsoft Intune to manage corporate devices. You need to design a compliance policy that requires devices to have a minimum OS version, be encrypted, and not be jailbroken or rooted. Additionally, you want to automatically block non-compliant devices from accessing corporate email. What should you configure?

Accepted Answer

Intune compliance policies and Conditional Access. Intune compliance policies and Conditional Access. Compliance policies in Intune define the specific requirements you listed—minimum OS version, encryption, and jailbreak/root detection—and Conditional Access then enforces those results by blocking non-compliant devices from accessing corporate resources such as Exchange Online email. The other options do not fit: device configuration profiles and Microsoft Entra ID join (B) configure settings and identity but do not evaluate compliance or block access; app protection policies and Defender for Endpoint (C) protect app data and detect threats but do not enforce device compliance for email access; and device enrollment restrictions (D) only control which devices can enroll, not ongoing compliance or access control.

Answer

Device configuration profiles and Azure AD join

Answer

App protection policies and Microsoft Defender for Endpoint

Answer

Device enrollment restrictions

Question 4

Your organization uses Microsoft Purview to classify and protect sensitive data. You need to prevent users from accidentally sharing files that contain credit card numbers via email. What should you configure in Microsoft Purview?

Accepted Answer

Implement a data loss prevention (DLP) policy that detects credit card numbers and blocks email sharing.. A DLP policy in Microsoft Purview is purpose-built to detect sensitive information types such as credit card numbers (via the built-in 'Credit Card Number' SIT, which uses regex plus Luhn checksum validation) and to enforce protective actions like blocking email sharing. DLP policies can be scoped to Exchange Online, SharePoint, OneDrive, and Teams, and can block or encrypt content when the sensitive data is detected. This directly addresses the requirement to prevent accidental email sharing of files containing credit card numbers.

Answer

Enable Microsoft Defender for Cloud Apps session policy to monitor file downloads.

Answer

Configure a retention policy for files containing credit card numbers.

Answer

Create a sensitivity label that automatically classifies credit card numbers.

Question 5

Refer to the exhibit. You are reviewing an Azure Policy definition that is assigned to a subscription. What is the primary effect of this policy?

Accepted Answer

It modifies the OS disk to use a specific disk encryption set.. The policy uses the 'modify' effect to add or replace the disk encryption set ID on any virtual machine's OS disk managed disk. This ensures VMs use a specific encryption set. 'deployIfNotExists' would deploy a resource, 'audit' would only log, 'deny' would block creation.

Answer

It deploys a disk encryption set to each virtual machine.

Answer

It denies creation of virtual machines without the specified disk encryption set.

Answer

It audits virtual machines that do not use the specified disk encryption set.

Question 6

A company uses Azure Policy to enforce compliance. They want to automatically remediate non-compliant resources by deploying a custom template. Which effect should they use in the policy definition?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is correct because it allows Azure Policy to automatically remediate non-compliant resources by deploying a custom ARM template when the resource is found to be non-compliant. This effect is specifically designed for automatic remediation scenarios, as it triggers a deployment to bring the resource into compliance without manual intervention.

Answer

Audit

Answer

Disabled

Answer

Deny

Question 7

You are designing identity security for a hybrid organization using Microsoft Entra ID. You need to enforce multi-factor authentication (MFA) for all users accessing sensitive applications. What is the recommended approach?

Accepted Answer

Create a Conditional Access policy that requires MFA for the sensitive applications. Conditional Access policies in Entra ID are the recommended method to require MFA for specific applications. The other options are less granular or outdated: per-user MFA is legacy, Security defaults apply to all apps and cannot be scoped, and Microsoft Entra ID Protection focuses on risk-based policies.

Answer

Enable Security defaults

Answer

Enable per-user MFA in Entra ID

Answer

Use Azure AD Identity Protection user risk policy

Question 8

Refer to the exhibit. You are reviewing a Microsoft Defender for Cloud automation resource. You want the automation to trigger a playbook in Microsoft Sentinel when a high-severity security assessment is found. Based on the exhibit, what is the missing configuration?

Accepted Answer

The action type should be 'LogicApp' instead of 'EventHub'. Microsoft Defender for Cloud automation can trigger a playbook in Microsoft Sentinel only by using a LogicApp action. The exhibit shows an EventHub action type, which is used for streaming events to an event hub, not for invoking a playbook. To trigger a Sentinel playbook from a Defender for Cloud assessment, the action type must be set to 'LogicApp' and configured with the playbook's trigger URL.

Answer

The severity filter should be 'Low' to capture all assessments

Answer

The eventSource should be 'Alerts' instead of 'Assessments'

Answer

The API version should be '2020-01-01'

Question 9

Which THREE capabilities are provided by Microsoft Defender for Cloud Apps (MDA) when integrated with Microsoft Defender XDR?

Accepted Answer

Discovery of shadow IT cloud apps.. Microsoft Defender for Cloud Apps (MDA) integrates with Microsoft Defender XDR to provide shadow IT discovery by analyzing traffic logs from network devices and cloud app catalogs, identifying unsanctioned cloud applications used in the organization. This capability is core to MDA's Cloud Discovery feature, which uses log parsing and machine learning to detect and classify shadow IT.

Answer

Email protection against phishing and malware.

Answer

Endpoint detection and response (EDR) for devices.

Question 10

Your organization uses Microsoft Entra ID and wants to implement a passwordless authentication strategy. Users have smartphones. Which method should you recommend as the primary authentication method?

Accepted Answer

Microsoft Authenticator app with passwordless sign-in. The Microsoft Authenticator app with passwordless sign-in is the correct primary method because it leverages the user's smartphone to provide a seamless, phishing-resistant authentication experience using public/private key cryptography (FIDO2/WebAuthn). This method aligns with the organization's goal of eliminating passwords while utilizing existing smartphone hardware, and it supports a simple user experience by requiring only a biometric or PIN verification on the phone.

Answer

FIDO2 security keys

Answer

SMS-based authentication

Answer

Windows Hello for Business

Question 11

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to design a solution that automatically creates an incident in Sentinel when a high-severity alert is generated in Defender for Cloud. What should you configure?

Accepted Answer

Enable the Microsoft Defender for Cloud data connector and create an analytics rule. The Microsoft Defender for Cloud data connector ingests security alerts from Defender for Cloud into Microsoft Sentinel. Once ingested, you create an analytics rule with a rule query that triggers on high-severity alerts and configures the rule to automatically create an incident. This is the standard method to convert a Defender for Cloud alert into a Sentinel incident without manual intervention.

Answer

Create a workbook to track alerts

Answer

Create a playbook in Microsoft Sentinel

Answer

Use a watchlist to import alerts

Question 12

A company wants to use Microsoft Defender XDR to correlate alerts across endpoints, email, and identities. Which component enables this correlation?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (the new name for Microsoft 365 Defender) is the unified pre- and post-breach enterprise defense suite that natively correlates signals from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps. Its correlation engine uses machine learning and the Microsoft Intelligent Security Graph to fuse alerts across these domains into a single incident, enabling security teams to see the full attack chain from email to endpoint to identity.

Answer

Microsoft 365 Defender

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Question 13

You are designing a backup strategy for Azure virtual machines using Azure Backup. The solution must support cross-region restore and provide 10 years of retention for compliance. Which THREE features should you enable? (Choose THREE.)

Accepted Answer

Cross-Region Restore. Option A (Cross-Region Restore) is correct because it is the Azure Backup feature that enables restoring data from a secondary, paired Azure region when the primary region's backup data is unavailable, directly satisfying the cross-region restore requirement. Option D (Immutable vault) is correct because enabling immutability on the Recovery Services vault prevents backup data from being deleted or modified before its retention period expires, which is essential for meeting the 10-year compliance retention requirement. Option E (Archive Tier) is correct because Azure Backup's archive tier supports long-term retention of recovery points for up to 10 years at lower cost, matching the compliance retention duration. Option B (Azure Site Recovery replication) is not a backup feature but a disaster-recovery orchestration service for replicating and failing over VMs, so it does not provide the required backup retention or cross-region restore of backup data. Option C (Soft Delete) only provides a 14-day grace period to recover deleted backup data and does not deliver cross-region restore or 10-year retention, so it does not meet the stated requirements.

Answer

Azure Site Recovery replication

Answer

Soft Delete

Question 14

A company is deploying Microsoft Defender for Cloud to secure their hybrid cloud environment. They need to ensure that regulatory compliance with PCI DSS is continuously monitored and reported. Which solution should they use to automatically assess and report compliance posture?

Accepted Answer

Regulatory compliance dashboard in Microsoft Defender for Cloud. The Regulatory compliance dashboard in Microsoft Defender for Cloud is the correct solution because it provides built-in, automated assessment of compliance against regulatory standards like PCI DSS. It continuously monitors your hybrid cloud environment against the PCI DSS controls, generates a compliance score, and produces detailed reports without requiring custom policy definitions. This dashboard integrates with Azure Policy to map controls to assessments, but the dashboard itself is the dedicated tool for viewing and reporting compliance posture.

Answer

Azure Policy

Answer

Microsoft Purview Information Protection

Answer

Microsoft Entra ID Governance

Question 15

Refer to the exhibit. You create this conditional access policy in Microsoft Entra ID. What is the result?

Accepted Answer

Blocks sign-ins from medium and high risk users for all applications. The conditional access policy shown assigns the 'Block access' control to the 'Medium and High' risk levels for 'All cloud apps'. This means any sign-in from a user or session detected as medium or high risk will be blocked, regardless of the application. Option B correctly identifies this outcome.

Answer

Requires MFA for medium and high risk users for all applications

Answer

Blocks sign-ins from low risk users for all applications

Answer

Blocks sign-ins from medium and high risk users only for selected applications