SC-100 Practice Test 38 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel for security operations. You need to ensure that an attacker cannot disable data collection by deleting the diagnostic settings on the Sentinel workspace. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply a CanNotDelete resource lock on the Log Analytics workspace.. Applying a CanNotDelete resource lock on the Log Analytics workspace prevents any user or process, including an attacker, from deleting the workspace or its diagnostic settings. This lock overrides all role-based permissions, ensuring that even if an attacker gains high-privileged access, they cannot remove the diagnostic settings that stream telemetry to Microsoft Sentinel. Sentinel's data collection relies entirely on these diagnostic settings, so protecting them with a resource lock is the most direct and effective defense against deletion attacks.

Answer

Enable Sentinel's workspace deletion protection.

Answer

Assign the Log Analytics Contributor role only to specific users.

Answer

Create an Azure Policy to audit diagnostic settings.

Question 2

Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM). You need to design a role activation policy that requires approval from a security group for global administrator roles, but allows self-activation for other roles. What is the correct configuration?

Accepted Answer

Configure separate PIM settings per role: Global Administrator requires approval, others self-activate. Privileged Identity Management (PIM) in Microsoft Entra ID allows you to configure role-specific activation settings. By creating separate PIM policies per role, you can require approval for the Global Administrator role while allowing self-activation for other roles. This granular control ensures that high-privilege roles have additional oversight, while lower-privilege roles remain agile.

Answer

Create a single PIM policy for all roles with approver group

Answer

Enable just-in-time access in Azure AD Identity Protection

Answer

Use Azure AD entitlement management with access packages

Question 3

Which TWO should you implement to protect privileged accounts in Microsoft Entra ID?

Accepted Answer

Conditional Access policies requiring MFA for privileged roles. Option B is correct because Conditional Access policies that require multifactor authentication for privileged directory roles (such as Global Administrator) enforce strong authentication at sign-in, directly reducing the risk of credential compromise for high-impact accounts. Option E is correct because Microsoft Entra Privileged Identity Management (PIM) provides just-in-time role activation, approval workflows, time-bound assignments, and access reviews, which minimize standing privileged access and its exposure window. Together, B and E address both authentication strength and the elimination of permanent admin rights, which are core controls for protecting privileged accounts in Entra ID. Option A (Microsoft Purview Data Loss Prevention) is incorrect because it protects sensitive data in motion/at rest rather than securing privileged identities. Option C (Microsoft Defender for Cloud security score) is incorrect because it is a posture assessment metric, not an access control for privileged accounts. Option D (Microsoft Defender Vulnerability Management) is incorrect because it identifies and remediates software vulnerabilities, not privileged identity protection.

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Defender for Cloud security score

Answer

Microsoft Defender Vulnerability Management

Question 4

Your company uses Microsoft Defender for Cloud to secure Azure workloads. You need to ensure that all storage accounts have the 'Secure transfer required' setting enabled. What should you use?

Accepted Answer

Azure Policy. Azure Policy can audit and enforce the 'Secure transfer required' setting across all storage accounts. Option A (RBAC) is incorrect because RBAC controls access permissions, not resource configuration. Option B (Azure Blueprints) is deprecated and not the direct solution for this requirement. Option C (Microsoft Defender for Cloud regulatory compliance dashboard) provides visibility but does not enforce settings.

Answer

Azure role-based access control (RBAC)

Answer

Azure Blueprints

Answer

Microsoft Defender for Cloud regulatory compliance dashboard

Question 5

Your organization uses Microsoft Intune to manage devices. You need to ensure that devices that are not compliant with your organization's security policies are blocked from accessing corporate resources. Which Intune feature should you configure?

Accepted Answer

Compliance policies. Compliance policies in Microsoft Intune define the rules and settings that devices must meet to be considered compliant (e.g., requiring a minimum OS version, encryption, or a healthy device health attestation). When a device is marked as non-compliant, Intune can automatically block access to corporate resources such as Exchange Online, SharePoint, or VPN by integrating with Conditional Access in Microsoft Entra ID. This is the correct feature because it directly evaluates device compliance and enforces access control.

Answer

App protection policies

Answer

Device configuration profiles

Answer

Enrollment restrictions

Question 6

Your organization is implementing a data loss prevention (DLP) strategy using Microsoft Purview. The compliance team needs to automatically classify and label sensitive data in Microsoft 365, Azure SQL Database, and Amazon S3. Which Purview feature should you use?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map is the correct choice because it provides unified data governance across hybrid and multi-cloud environments, including Microsoft 365, Azure SQL Database, and Amazon S3. It automatically scans, classifies, and labels sensitive data using built-in classifiers and sensitivity labels, enabling consistent DLP policies across these disparate data sources.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Records Management

Answer

Microsoft Defender for Cloud Apps

Question 7

A company uses Microsoft Sentinel and wants to prioritize incidents using user risk scores from Microsoft Entra ID Protection. Which configuration should they use to automatically assign a Sentinel severity based on the user's risk level?

Accepted Answer

Create a custom analytics rule that uses the RiskLevel field to set severity. A is correct because Microsoft Sentinel's custom analytics rules can directly reference the `RiskLevel` field from Microsoft Entra ID Protection user risk data ingested via the UEBA connector. By writing a KQL query that checks the user's risk level (e.g., `RiskLevel == 'high'`) and mapping it to a Sentinel severity (e.g., High, Medium, Low) within the rule's incident creation settings, you automate severity assignment without external dependencies. This native integration ensures real-time synchronization of risk levels to incident priority.

Answer

Configure an automation rule to set severity when risk is high

Answer

Use a watchlist to map risk levels to severity

Answer

Create a playbook that assigns severity based on risk

Question 8

Wide World Importers uses Azure Active Directory (now Microsoft Entra ID) and Microsoft 365. They have a hybrid identity with password hash sync. They want to implement a passwordless authentication strategy to improve security and user experience. They have a mix of Windows 10/11 devices and mobile devices (iOS/Android). They also have some shared computers in kiosk mode. The solution must support all user scenarios and align with Microsoft's authentication best practices. What should you recommend?

Accepted Answer

Implement Windows Hello for Business for Windows 10/11 devices. Deploy Microsoft Authenticator for mobile devices for passwordless sign-in. Use FIDO2 security keys for shared computers and kiosk scenarios. Enable combined registration for self-service password reset and Microsoft Authenticator.. It aligns with Microsoft's passwordless authentication best practices by using Windows Hello for Business for Windows 10/11 devices (which supports biometric and PIN-based sign-in), Microsoft Authenticator for mobile devices (enabling phone-sign-in passwordless authentication), and FIDO2 security keys for shared computers and kiosk scenarios (which provide hardware-backed, phishing-resistant credentials). Combined registration streamlines the user enrollment process for both SSPR and Microsoft Authenticator, ensuring a seamless deployment across all device types.

Answer

Use SMS-based authentication for all users. Deploy OATH tokens for shared computers. Implement Azure AD Conditional Access to require passwordless for admins only.

Answer

Implement Windows Hello for Business for all Windows devices. Use smart cards for mobile devices. Use FIDO2 keys for shared computers.

Answer

Use the Microsoft Authenticator app for all users. Configure passwordless sign-in with the app. Use QR codes for kiosk computers.

Question 9

Your organization is using Microsoft Defender for Cloud to assess the security posture of your Azure resources. You need to ensure that all storage accounts have secure transfer required enabled. Which Defender for Cloud feature should you use?

Accepted Answer

Security policies and initiatives. Security policies and initiatives in Microsoft Defender for Cloud are the correct choice because they let you define and assign Azure Policy definitions—such as the built-in 'Secure transfer to storage accounts should be enabled' policy—that continuously assess storage accounts and flag any that lack Secure transfer required (HTTPS-only). This directly addresses the requirement to ensure all storage accounts have secure transfer enabled. File integrity monitoring is incorrect because it tracks changes to OS files and registry keys on VMs, not storage account configuration. Adaptive network hardening is incorrect because it generates NSG rules based on traffic analysis, and Just-In-Time VM access is incorrect because it restricts inbound VM ports on demand—neither evaluates storage account encryption-in-transit settings.

Answer

File integrity monitoring

Answer

Adaptive network hardening

Answer

Just-In-Time VM access

Question 10

Your company is designing a hybrid identity solution using Microsoft Entra ID. You need to ensure that users can access on-premises applications using modern authentication methods. The solution must support multi-factor authentication and Conditional Access policies. What should you implement?

Accepted Answer

Microsoft Entra application proxy. Microsoft Entra application proxy publishes on-premises web applications to the cloud, letting remote users reach them through Entra ID. Because authentication flows through Entra ID, it natively supports modern authentication, MFA, and Conditional Access policies. This is the correct solution for hybrid access to on-prem apps with modern identity controls.

Answer

Microsoft Entra Connect

Answer

Azure AD Domain Services

Answer

Microsoft Intune

Question 11

Your organization has a Microsoft 365 E5 subscription and wants to detect insider data exfiltration attempts. You need to design a solution that can identify users copying sensitive data to personal cloud storage services. Which Microsoft Purview capability should you use?

Accepted Answer

Insider Risk Management. Microsoft Purview Insider Risk Management is designed to detect, investigate, and act on risky user activities such as data exfiltration to personal cloud storage. It uses machine learning and policy templates to correlate signals like unusual downloads, uploads to personal cloud services, and other indicators of insider risk. DLP policies enforce data handling rules but do not focus on detecting insider intent or anomalous behavior.

Answer

Data Loss Prevention (DLP) policies

Answer

eDiscovery (Premium)

Answer

Communication Compliance

Question 12

Your company uses Microsoft Sentinel as a SIEM. You need to create an analytics rule that detects when a user account is created outside of business hours. The rule should trigger an incident for investigation. Which type of analytics rule should you use?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because it allows you to define a KQL query that checks for user account creation events (e.g., from the SecurityEvent or AuditLogs table) and then use the query scheduling settings to run the query at a specific interval. You can then add a condition in the rule logic to filter for events occurring outside business hours (e.g., using the `datetime_part` function to check the hour of the event). When the query returns results, Sentinel automatically generates an incident for investigation.

Answer

Anomaly rule

Answer

Fusion rule

Answer

NRT query rule

Question 13

Your organization uses Microsoft Entra ID and needs to implement a Zero Trust identity strategy. Which THREE principles should you apply?

Accepted Answer

Use least privilege access. The Zero Trust identity model in Microsoft Entra ID is built on three core principles, and option B (Verify explicitly) is correct because every access request must be authenticated and authorized based on all available signals—user identity, device health, location, and risk—rather than trusting based on network location. Option A (Use least privilege access) is correct because Zero Trust requires granting just-enough, just-in-time access using tools like Privileged Identity Management (PIM) and conditional access so users only get the permissions needed for the task. Option E (Assume breach) is correct because Zero Trust assumes the network is already compromised and therefore uses micro-segmentation, end-to-end encryption, and analytics to minimize blast radius and detect threats. Option C (Trust implicitly) is incorrect because it is the opposite of Zero Trust—implicit trust based on being inside the corporate network is exactly what Zero Trust eliminates. Option D (Use a single authentication method) is incorrect because Zero Trust favors strong, phishing-resistant multi-factor authentication (such as FIDO2 or Windows Hello for Business) rather than relying on a single authentication factor.

Answer

Trust implicitly

Answer

Use a single authentication method

Question 14

Which TWO Azure policies should you assign to enforce secure configuration of Azure SQL Database? (Select two.)

Accepted Answer

Ensure that 'Auditing' is set to 'On' for SQL Database. Option A is correct because the built-in Azure Policy 'Auditing on SQL Database should be enabled' enforces that auditing is set to 'On' for Azure SQL Database, ensuring database activity is logged for security and compliance monitoring. Option D is correct because the policy 'Firewall and virtual network settings for SQL Database should be configured' enforces that Azure SQL Database has network-level access controls (firewall rules or virtual network service endpoints/private endpoints) in place, restricting access to authorized networks only. Option B is incorrect because it targets TDE on SQL Server running on VMs (IaaS), not Azure SQL Database (PaaS), so it does not apply to this scenario. Option C is incorrect because it audits the SQL Server-level audit setting rather than enforcing a secure configuration on Azure SQL Database itself. Option E is incorrect because it concerns secure transfer for storage accounts, which is unrelated to Azure SQL Database configuration.

Answer

Ensure that 'TDE' is enabled for SQL Server VMs

Answer

Audit SQL Server level audit setting

Answer

Ensure secure transfer to storage accounts is enabled

Question 15

Refer to the exhibit. You are reviewing an ARM template for a storage account. The security team has mandated that all storage accounts must enforce HTTPS traffic and use TLS 1.2 or higher. Which two changes must be made to the template to comply? (Choose two.)

Accepted Answer

Change 'minimumTlsVersion' to 'TLS1_2'. Option A is correct because the storage account property 'minimumTlsVersion' must be set to 'TLS1_2' (or higher, such as 'TLS1_3' where supported) to enforce TLS 1.2 or above, satisfying the security team's TLS requirement. Option E is correct because the 'supportsHttpsTrafficOnly' property must be set to true so the storage account rejects non-HTTPS (HTTP) requests, enforcing HTTPS traffic. Option B is incorrect because 'kind' (BlobStorage vs StorageV2) controls the type of storage account and its supported features, not HTTPS or TLS enforcement. Option C is incorrect because 'networkAcls' with defaultAction Deny restricts network access by IP or virtual network, which is unrelated to enforcing HTTPS or TLS versions. Option D is incorrect because 'sku.name' (Standard_LRS) only defines the redundancy/replication tier and performance level, not transport security settings.

Answer

Set 'kind' to 'BlobStorage'

Answer

Add 'networkAcls' with defaultAction Deny

Answer

Change 'sku.name' to 'Standard_LRS'