SC-100 Practice Test 37 — 15 Questions

Question 1

You are designing a backup strategy for a Microsoft 365 tenant. You need to ensure that Exchange Online mailbox items deleted by users can be recovered up to 30 days after deletion, without using third-party tools. What should you configure?

Accepted Answer

Enable single item recovery for the mailbox.. Option A is correct because single item recovery in Exchange Online allows recovery of deleted items up to 30 days. Option B is wrong because litigation hold preserves items indefinitely, not recovery after deletion. Option C is wrong because retention policies are for retention, not recovery. Option D is wrong because Azure Backup for Microsoft 365 is a third-party-like feature (actually Microsoft but not the simplest built-in).

Answer

Place the mailbox on litigation hold.

Answer

Create a Microsoft 365 retention policy for Exchange mailboxes.

Answer

Configure Azure Backup for Microsoft 365.

Question 2

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that devices must have a minimum OS version and cannot be jailbroken. Which configuration profile type should you assign?

Accepted Answer

Compliance policy.. Option B is correct because compliance policies define requirements like OS version and jailbreak detection. Option A is wrong because device restrictions enforce settings, not compliance. Option C is wrong because configuration policies are for settings. Option D is wrong because enrollment restrictions apply during enrollment.

Answer

Device configuration policy.

Answer

Device restrictions profile.

Answer

Enrollment restriction.

Question 3

A company is migrating its on-premises Active Directory to Microsoft Entra ID. They have line-of-business applications that use Windows Integrated Authentication. You need to design a solution that allows users to access these applications from domain-joined devices without prompting for credentials, while also supporting hybrid identity. What should you implement?

Accepted Answer

Configure Microsoft Entra hybrid join and enable Seamless SSO.. Option D is correct because Microsoft Entra hybrid join allows domain-joined devices to authenticate to both on-prem and cloud resources, enabling SSO. Option A is incorrect because Azure AD Application Proxy requires separate authentication. Option B is incorrect because Pass-through Authentication is for cloud apps, not on-prem. Option C is incorrect because Federation does not provide device-based SSO for on-prem apps.

Answer

Deploy Pass-through Authentication (PTA) with Seamless SSO.

Answer

Use Azure AD Application Proxy with pre-authentication.

Answer

Implement Active Directory Federation Services (AD FS).

Question 4

Your organization is deploying a new application on Azure Kubernetes Service (AKS). You need to ensure that only authorized containers can run in the cluster and that any unauthorized containers are automatically blocked. What should you configure?

Accepted Answer

Apply an Azure Policy that restricts container images to only those from approved registries.. Option A is correct because Azure Policy for AKS, using the built-in 'Kubernetes cluster containers should only use allowed images' policy, ensures that only images from approved registries can run. Option B is wrong because Azure RBAC controls who can manage the cluster, not which containers run. Option C is wrong because network policies control traffic, not container authorization. Option D is wrong because Azure AD integration controls authentication, not container image approval.

Answer

Implement network policies to restrict communication between pods.

Answer

Enable Azure AD integration for the AKS cluster.

Answer

Configure Azure RBAC roles to limit who can deploy containers.

Question 5

Refer to the exhibit. You are deploying an ARM template that creates a network security group (NSG) named nsg-backend. What is the effect of this NSG on inbound traffic?

Accepted Answer

Only inbound traffic from 10.0.1.0/24 on port 80 is allowed; all other inbound traffic is denied. Option B is correct. The NSG has two rules: AllowHTTPFromFrontend with priority 100 allows TCP 80 from 10.0.1.0/24, and DenyAllInbound with priority 1000 denies all other inbound traffic. Since the allow rule has a higher priority (lower number), traffic from the frontend subnet on port 80 is allowed, and all other inbound traffic is denied. Option A is wrong because traffic from 10.0.1.0/24 on port 80 is allowed. Option C is wrong because the explicit deny rule exists. Option D is wrong because the deny rule is not the only rule.

Answer

Only inbound traffic on port 80 is denied

Answer

All inbound traffic is allowed because no default deny rule is present

Answer

All inbound traffic is allowed except from 10.0.1.0/24

Question 6

You are designing a secure solution for an Azure Kubernetes Service (AKS) cluster that hosts a critical application. You need to ensure that pods can only communicate with specific back-end services and that traffic is encrypted. What should you implement?

Accepted Answer

Implement Kubernetes network policies and enable mTLS using a service mesh like Istio or Linkerd.. Option C is correct because network policies in AKS control pod-to-pod communication, and mutual TLS (mTLS) with a service mesh encrypts traffic. Option A is wrong because Azure Firewall controls ingress/egress, not pod-to-pod. Option B is wrong because NSGs are for subnet-level, not pod-level. Option D is wrong because App Gateway is for ingress.

Answer

Use network security groups (NSGs) on the subnet.

Answer

Configure Azure Application Gateway Ingress Controller.

Answer

Deploy Azure Firewall and configure application rules.

Question 7

Which TWO features of Microsoft Defender for Cloud help you identify and remediate misconfigurations in your Azure environment? (Choose two.)

Accepted Answer

Security recommendations.. Options B and D are correct. B: Security recommendations provide actionable steps to fix misconfigurations. D: Secure score measures overall security posture and guides prioritization. Option A is wrong because JIT is for VM access. Option C is wrong because FIM is for file integrity. Option E is wrong because adaptive application controls are for allowed apps.

Answer

File integrity monitoring (FIM).

Answer

Just-in-time (JIT) VM access.

Answer

Adaptive application controls.

Question 8

A company is implementing a zero-trust network for their Azure environment. They want to ensure that only authenticated and authorized users can access specific VMs, regardless of network location. Which Azure service should they use?

Accepted Answer

Azure Bastion. Option A is correct because Azure Bastion provides secure, RDP/SSH access to VMs without public IPs, and integrates with Entra ID for authentication. Option B is wrong because site-to-site VPN requires network connectivity, not zero-trust. Option C is wrong because Just-in-Time (JIT) VM access reduces exposure but still requires a public IP. Option D is wrong because NSGs filter by IP, not user identity.

Answer

Just-in-Time (JIT) VM Access

Answer

Site-to-Site VPN

Answer

Network Security Groups (NSGs)

Question 9

Which TWO of the following are valid methods to secure Azure Kubernetes Service (AKS) workloads?

Accepted Answer

Integrate Azure AD for cluster authentication. Option A is correct because Azure AD integration enables authentication for AKS clusters. Option C is correct because Azure Policy with Gatekeeper can enforce security policies on AKS. Option B is wrong because Network Security Groups apply to VMs, not AKS pods. Option D is wrong because Azure Firewall is for network-level filtering, not workload security. Option E is wrong because Azure Front Door is for global load balancing, not AKS workload security.

Answer

Apply Network Security Groups to pod subnets

Answer

Deploy Azure Firewall in front of the AKS cluster

Answer

Use Azure Front Door to protect API endpoints

Question 10

Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to ensure that user passwords are synchronized securely and that password changes on-premises are reflected in the cloud quickly. Which tool should you configure?

Accepted Answer

Microsoft Entra Connect. Option B is correct because Azure AD Connect synchronizes identities and passwords with hash synchronization. Option A is wrong because Microsoft Entra Connect is the same as Azure AD Connect. Option C is wrong because AD FS is for federation, not password synchronization. Option D is wrong because Microsoft Identity Manager is for identity governance, not synchronization.

Answer

Azure AD Connect

Answer

Active Directory Federation Services (AD FS)

Answer

Microsoft Identity Manager

Question 11

You are designing a secure CI/CD pipeline for Azure using GitHub Actions. You need to ensure that secrets (e.g., Azure service principal credentials) are stored securely and accessed only by authorized actions. What should you use?

Accepted Answer

Use GitHub Actions secrets to store the credentials.. Option B is correct because GitHub Actions secrets are encrypted and can be scoped to repositories or environments. Option A is wrong because storing secrets in code is insecure. Option C is wrong because Key Vault can be accessed from GitHub Actions via a secret, but the primary secure storage for GitHub is secrets. Option D is wrong because managed identities are not directly usable in GitHub Actions without a secret to authenticate.

Answer

Use Azure AD managed identities for GitHub Actions.

Answer

Store secrets in Azure Key Vault and access them using a service principal secret stored in GitHub.

Answer

Store secrets as environment variables in the GitHub repository.

Question 12

You are designing a secure access solution for a manufacturing company's IoT devices that send telemetry to Azure IoT Hub. The devices run on a private network with no internet access except through a firewall. You need to ensure that device-to-cloud communication is authenticated and encrypted, and that device credentials are rotated regularly. What should you include in the design?

Accepted Answer

Use X.509 certificates with Azure Device Provisioning Service (DPS) for automatic enrollment and certificate rotation.. Option A is correct because X.509 certificates with auto-enrollment via DPS provide strong authentication, encryption (TLS), and automated certificate rotation. Option B is incorrect because SAS tokens require manual rotation and are less secure. Option C is incorrect because managed identities are for Azure resources, not IoT devices. Option D is incorrect because Azure Firewall is a network security component, not an authentication mechanism.

Answer

Configure Azure Firewall to authenticate and encrypt device traffic.

Answer

Use shared access signature (SAS) tokens with a central key management system.

Answer

Assign managed identities to each IoT device.

Question 13

Your organization plans to deploy Microsoft Defender for Cloud to protect hybrid workloads. You need to design the agentless scanning deployment for Azure VMs running SQL Server. What should you configure?

Accepted Answer

In Microsoft Defender for Cloud, enable the 'defenderForSql' plan and set the 'agentlessScanning' property to 'true'.. Agentless scanning for SQL Server on Azure VMs is enabled via defenderForSql in the Defender plan, not via Azure Policy or SQL Vulnerability Assessment. Option C is correct because it directly enables agentless scanning. Option A is wrong because Azure Policy can enforce scanning but is not the configuration mechanism. Option B is wrong because SQL Vulnerability Assessment is a separate feature. Option D is wrong because just enabling Defender for Cloud does not automatically scan SQL.

Answer

Deploy the Log Analytics agent on each SQL Server VM.

Answer

Enable SQL Vulnerability Assessment in Microsoft Defender for Cloud.

Answer

Configure Azure Policy to assign the 'Enable Defender for Cloud for SQL Servers' initiative.

Question 14

Your organization is migrating on-premises Active Directory to Microsoft Entra ID. You need to design the authentication method to support hybrid identities with seamless single sign-on (SSO) for legacy applications that require Kerberos authentication. What should you implement?

Accepted Answer

Enable Microsoft Entra Seamless SSO via Microsoft Entra Connect.. Option D is correct because Microsoft Entra Connect with Seamless SSO enables Kerberos-based authentication for hybrid users. Option A is wrong because federation with ADFS is not required for Kerberos. Option B is wrong because PHS does not support Kerberos delegation. Option C is wrong because PTA does not support Kerberos.

Answer

Federate Microsoft Entra ID with on-premises Active Directory using ADFS.

Answer

Use password hash synchronization (PHS) only.

Answer

Deploy pass-through authentication (PTA).

Question 15

Refer to the exhibit. You are reviewing a Microsoft Sentinel analytics rule in your workspace. The output shows the rule 'MFA Disabled' is enabled with severity Medium. The query returns events where MFA is absent. What is the primary issue with this rule?

Accepted Answer

The query does not include a time range, which will cause excessive alerts.. Option C is correct because the query is too broad and will generate excessive alerts (no time filter). Option A is wrong because the severity is Medium, which is acceptable. Option B is wrong because the rule is enabled. Option D is wrong because the threshold and operator are defined.

Answer

The rule should be disabled until tuned.

Answer

The severity should be High.

Answer

The trigger threshold is too low.