SC-100 Practice Test 36 — 15 Questions

Question 1

A SOC team uses Microsoft Sentinel for incident management. They need to ensure that when a high-severity incident is created, a Teams message is sent to the security team and an email is sent to the IT manager. What is the most efficient way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an automation rule in Sentinel that triggers a playbook to send the notifications.. Automation rules in Microsoft Sentinel can trigger a playbook (an Azure Logic Apps workflow) when an incident is created, allowing you to send a Teams message and an email simultaneously. This is the most efficient, automated approach without manual intervention or modifying the analytics rule itself.

Answer

Configure the analytics rule to send notifications when an incident is created.

Answer

Use a workbook to display incidents and have a manual process to send notifications.

Answer

Enable incident creation in the data connector settings.

Question 2

The exhibit shows a conditional access policy from Microsoft Entra ID Identity Protection. When will this policy require MFA?

Accepted Answer

When user risk is medium or high AND sign-in risk is high. The conditional access policy shown in the exhibit uses the 'Require MFA' grant control with conditions set for user risk (medium or high) AND sign-in risk (high). In Microsoft Entra ID Identity Protection, when both risk levels are evaluated together with an AND operator, MFA is only triggered when both conditions are met simultaneously. This ensures that MFA is enforced only when the user account itself is compromised (medium/high user risk) and the current sign-in session is also risky (high sign-in risk), providing a layered security response.

Answer

When either user risk is medium or sign-in risk is high

Answer

When user risk is medium or high, regardless of sign-in risk

Answer

When sign-in risk is high, regardless of user risk

Question 3

Your organization uses Microsoft Sentinel and has enabled User and Entity Behavior Analytics (UEBA). The security team receives an alert for a user who has failed authentication 10 times in 5 minutes. What should you configure to reduce false positives while ensuring legitimate brute-force attacks are still detected?

Accepted Answer

Customize the anomaly threshold in UEBA. Customizing the anomaly threshold in UEBA allows you to adjust the sensitivity of the behavioral baseline, reducing false positives for users who legitimately fail authentication multiple times while still detecting true brute-force attacks. UEBA learns normal behavior patterns and flags deviations; by raising the threshold, you require a higher deviation from the baseline before an alert fires, preserving detection of actual attacks.

Answer

Disable UEBA for that user

Answer

Modify the analytics rule that triggered the alert

Answer

Create a playbook to auto-acknowledge the alert

Question 4

The exhibit shows a conditional access policy in Microsoft Entra ID. What will be the effect of this policy?

Accepted Answer

Block all applications except Office365. The exhibit shows a Conditional Access policy that includes 'All cloud apps' in the target resources and is configured with a 'Block access' grant control. The 'Exclude' list contains 'Office365', meaning the policy applies to all applications except Office365. Therefore, the effect is to block access to all applications except Office365, making option D correct.

Answer

Allow all applications except Office365

Answer

Block all applications including Office365

Answer

Allow all applications including Office365

Question 5

Your organization uses Microsoft Entra ID and Microsoft Intune. You need to design a solution that allows only hybrid Azure AD joined devices to access a sensitive application. The solution must also require that the device is compliant with company policies. Which two components should you configure? (Choose TWO.)

Accepted Answer

Conditional Access policy with 'Require hybrid Azure AD joined device'. Option C is correct because a Conditional Access policy with the 'Require hybrid Microsoft Entra ID joined device' grant control enforces that only devices registered as hybrid Microsoft Entra ID joined can access the sensitive application, directly satisfying the device-trust requirement. Option E is correct because an Intune device compliance policy defines and evaluates the rules (such as OS version, encryption, and password requirements) that determine whether a device is compliant, and Conditional Access can then require a compliant device. Together, C and E let Conditional Access grant access only when the device is both hybrid Microsoft Entra ID joined and compliant. Option A is not correct because Intune app protection policies (MAM) protect app data on mobile devices and do not enforce hybrid Microsoft Entra ID join or device compliance for Conditional Access. Option B is not correct because requiring multifactor authentication verifies the user, not the device's join state or compliance. Option D is not correct because device enrollment merely onboards devices into Intune; it does not itself enforce the hybrid join or compliance requirements at access time.

Answer

Intune app protection policy

Answer

Conditional Access policy with 'Require multifactor authentication'

Answer

Intune device enrollment

Question 6

Your organization is implementing Microsoft Defender for Cloud Apps to protect against malicious OAuth app permissions. Users have been granting permissions to third-party apps that request excessive scopes. What should you configure to automatically revoke such permissions?

Accepted Answer

OAuth app policies in Defender for Cloud Apps. The correct option is A, OAuth app policies in Defender for Cloud Apps. These policies are purpose-built to detect risky or over-privileged OAuth apps and can automatically revoke user-granted permissions or disable the app when it matches conditions such as excessive scopes or low community use. Intune app protection policies (B) govern mobile app data handling (MAM) and do not revoke OAuth consent grants. Conditional Access policies (C) control sign-in conditions and session access, not OAuth permission revocation. Microsoft Entra ID app permissions management (D) allows reviewing and revoking consent grants manually but does not provide the automated, risk-based revocation that Defender for Cloud Apps OAuth app policies deliver.

Answer

Microsoft Intune app protection policies

Answer

Conditional Access policies

Answer

Azure AD app permissions management

Question 7

A global enterprise uses Microsoft Entra ID with Privileged Identity Management (PIM) and Conditional Access. They need to ensure that all privileged role activations require an approval workflow, and that the approval process is documented for compliance. What configuration should they implement?

Accepted Answer

In PIM, edit the role settings to require approval for activation. To require approval for privileged role activations in PIM, you must edit the role settings for the specific role and enable the 'Require approval to activate' option. This ensures that when a user activates the role, an approver must approve the request, and the approval is logged for compliance.

Answer

Create a Conditional Access policy requiring an Authentication Strength

Answer

Configure an access review for the privileged roles

Answer

Create a role-assignable group and assign the privileged role to the group

Question 8

Your company uses Microsoft Defender XDR to protect endpoints. The security team wants to implement automated response actions when a malicious file is detected on a device. Which Microsoft security feature should you configure to automatically isolate the affected device from the network?

Accepted Answer

Automated investigation and response (AIR) capabilities. Automated investigation and response (AIR) in Microsoft Defender XDR is the correct feature because it includes built-in playbooks that can automatically isolate a device from the network when a malicious file is detected. AIR leverages the Microsoft 365 Defender portal's automation capabilities to run investigation steps and execute response actions, such as device isolation, without manual intervention. This directly meets the requirement for automated response upon file detection.

Answer

Microsoft Sentinel automation rules

Answer

Attack surface reduction rules

Answer

Microsoft Intune compliance policies

Question 9

A financial services company is designing a secure infrastructure for their Azure SQL Database. They need to encrypt data at rest using customer-managed keys (CMK) stored in a key vault with soft-delete and purge protection enabled. The encryption must be transparent to applications. What should they configure?

Accepted Answer

Transparent Data Encryption (TDE) with Azure Key Vault. Azure SQL Database supports Transparent Data Encryption (TDE) with CMK in Azure Key Vault. Always Encrypted is for column-level encryption. Dynamic Data Masking is for masking, not encryption. Azure Information Protection is for classification.

Answer

Azure Information Protection

Answer

Dynamic Data Masking

Answer

Always Encrypted

Question 10

Order the steps to troubleshoot an Azure VPN gateway connection failure.

Accepted Answer

First, verify the Azure VPN gateway configuration and status in the Azure portal. Next, check the on-premises VPN device configuration and connectivity. Then, verify the shared key and IPsec/IKE parameters match. Finally, if issues persist, initiate a reset of the Azure VPN gateway.. Troubleshooting starts with Azure side, then on-premises, and may require reset.

Answer

First, reset the Azure VPN gateway. Next, verify the on-premises VPN device configuration. Then, check the Azure VPN gateway status. Finally, regenerate the shared key.

Answer

First, check the on-premises VPN device. Next, verify the Azure VPN gateway. Then, reset the on-premises device. Finally, update the shared key.

Answer

First, change the shared key. Next, reset the Azure VPN gateway. Then, check the on-premises device. Finally, verify the Azure gateway.

Question 11

Fabrikam is a healthcare organization that uses Microsoft 365 E5 and Azure. They have a hybrid identity environment with Active Directory on-premises synced to Microsoft Entra ID. The security team wants to implement a Zero Trust strategy following the 'verify explicitly' principle. They need to ensure that all access to Microsoft 365 services and Azure applications is conditionally enforced based on real-time risk signals. Additionally, they want to block legacy authentication protocols that do not support modern authentication. The solution must integrate with Microsoft Defender XDR and Microsoft Sentinel for threat intelligence. Which combination of technologies should you recommend?

Accepted Answer

Use Microsoft Entra Conditional Access policies with session controls from Microsoft Defender for Cloud Apps. Enable Microsoft Entra ID Protection to feed risk signals into Conditional Access. Block legacy authentication via a Conditional Access policy targeting 'Exchange Active Sync' and 'Other clients'. Integrate Microsoft Sentinel to ingest alerts from Defender XDR.. It directly implements the 'verify explicitly' principle by using Microsoft Entra ID Protection to feed real-time risk signals into Conditional Access policies, which then enforce session controls via Microsoft Defender for Cloud Apps. It blocks legacy authentication through a targeted Conditional Access policy (not just disabling protocols in Exchange Online or at the firewall), and integrates Microsoft Sentinel to ingest alerts from Defender XDR for centralized threat intelligence. This combination ensures all access to Microsoft 365 and Azure applications is conditionally enforced based on dynamic risk, while also addressing the requirement to block legacy protocols that lack modern authentication support.

Answer

Implement Azure AD Identity Governance with access reviews. Use Conditional Access to require hybrid Azure AD joined devices. Block legacy authentication by disabling protocols in Exchange Online. Use Azure Sentinel without Defender XDR.

Answer

Use Azure AD B2B for external users only. Configure Conditional Access with MFA for all users. Use Azure AD Identity Protection for risk. Block legacy authentication at the firewall level.

Answer

Deploy Microsoft Intune for mobile device management and require compliant devices. Use Conditional Access to block legacy protocols. Rely on Azure ATP (now Microsoft Defender for Identity) for risk signals.

Question 12

A company is designing an application architecture using Azure Kubernetes Service (AKS) and Azure Cosmos DB. The application requires that secrets (database connection strings) be injected into pods securely without storing them in the container image. The solution must minimize management overhead. What is the recommended approach?

Accepted Answer

Use Azure Key Vault Provider for Secrets Store CSI Driver to mount secrets as volumes in pods.. The Azure Key Vault Provider for Secrets Store CSI Driver integrates directly with AKS to securely inject secrets from Azure Key Vault into pods as mounted volumes or environment variables, without storing them in container images or Kubernetes objects. This approach minimizes management overhead by leveraging Azure-managed Key Vault for secret lifecycle management and avoids the operational burden of manually managing Kubernetes Secrets.

Answer

Store secrets in a Kubernetes ConfigMap and reference them in the deployment YAML.

Answer

Define secrets in a Kubernetes Secret object and reference them in the pod spec.

Answer

Hardcode the connection string in an environment variable in the deployment manifest.

Question 13

Refer to the exhibit. An Azure policy is defined as shown. Which resources will be audited?

Accepted Answer

Virtual machines with Standard_LRS managed disks. The Azure policy definition in the exhibit uses the 'audit' effect to evaluate a condition that checks whether the virtual machine's managed disk storage account type is 'Standard_LRS'. When the condition is true (i.e., the VM has a Standard_LRS managed disk), the policy triggers an audit event. Therefore, the policy audits all virtual machines with Standard_LRS managed disks, making option C correct. Options A, B, and D are incorrect because the policy does not audit all non-compliant resources, unmanaged disks, or VMs with Premium_LRS disks of size 1024 GB.

Answer

All Azure resources that are not compliant

Answer

All virtual machines with unmanaged disks

Answer

Virtual machines with Premium_LRS managed disks and disk size 1024 GB

Question 14

Your company plans to deploy Microsoft Defender for Cloud to secure a multi-cloud environment that includes Azure, AWS, and GCP. You need to ensure that security recommendations from all three cloud providers are centrally visible. What should you configure?

Accepted Answer

Onboard AWS and GCP accounts to Microsoft Defender for Cloud using the multicloud connectors feature.. The correct option is A: onboarding AWS and GCP accounts to Microsoft Defender for Cloud using the multicloud connectors feature. This is the native capability that lets Defender for Cloud pull security posture and recommendations from AWS and GCP into the same central dashboard as Azure, giving a unified view across all three clouds. Option B is wrong because Azure Policy and Azure Arc govern and configure resources but do not aggregate AWS/GCP security recommendations into Defender for Cloud. Option C is wrong because Microsoft Sentinel is a SIEM/SOAR for log ingestion and workbooks, not the mechanism that surfaces Defender for Cloud recommendations. Option D is wrong because AWS Security Hub and Google Cloud Security Command Center are separate provider-native tools and do not provide a single centralized Defender for Cloud view.

Answer

Deploy Azure Policy on AWS and GCP using Azure Arc to enforce security policies.

Answer

Ingest security logs from AWS and GCP into Microsoft Sentinel and use workbooks to view recommendations.

Answer

Connect AWS accounts to AWS Security Hub and GCP accounts to Google Cloud Security Command Center, then view via a single pane of glass.

Question 15

A company uses Microsoft Defender for Cloud to assess the security posture of their Azure subscriptions. They want to receive alerts when a resource is deployed without encryption enabled. What should they configure?

Accepted Answer

Azure Policy definition to audit or deny resources without encryption. Azure Policy with a custom policy definition can audit or deny resources without encryption. Defender for Cloud's regulatory compliance dashboard shows compliance status. Security alerts are for threats, not configuration drift. Azure Blueprints are for packaging resources.

Answer

Azure Blueprints

Answer

Microsoft Defender for Cloud regulatory compliance dashboard

Answer

Microsoft Defender for Cloud security alerts