SC-100 Practice Test 39 — 15 Questions

Question 1

Refer to the exhibit. A company applies this Azure Policy to their subscription. An administrator tries to create a VM with a public IP address. What will happen?

Accepted Answer

The VM creation will be denied. Option A is correct because the policy denies creation of network interfaces with a public IP. Option B is wrong because the policy does not audit, it denies. Option C is wrong because the policy applies to all resources. Option D is wrong because the policy does not create a public IP.

Answer

The public IP will be automatically removed

Answer

The VM will be created, but an alert will be generated

Answer

The policy will only apply to VMs in a specific resource group

Question 2

Refer to the exhibit. You are reviewing an Azure Policy definition. What does this policy do?

Accepted Answer

Denies creation of any virtual machine that is attached to a public IP address.. Option A is correct because the policy denies creation of virtual machines that have any network interface (NIC) attached to a public IP (by checking the NIC's id field, which would be present if attached). Option B is wrong because the policy does not target VMs without a NIC. Option C is wrong because the policy denies VMs with NICs, not VMs without NICs. Option D is wrong because the policy does not check for a specific subnet.

Answer

Denies creation of any virtual machine that has a network interface attached to a specific subnet.

Answer

Denies creation of any virtual machine that does not have a network interface.

Answer

Allows creation of virtual machines only if they have a network interface attached to a specific subnet.

Question 3

Your organization uses Microsoft Defender for Identity (MDI) to protect on-premises Active Directory. You need to integrate MDI with Microsoft Sentinel to centralize detection and response. What is the required configuration?

Accepted Answer

Enable the Microsoft Defender for Identity data connector in Microsoft Sentinel.. Option A is correct because the MDI data connector in Sentinel enables ingestion of MDI alerts. Option B is wrong because MDI does not use Syslog for its native alerts; it uses a specific connector. Option C is wrong because Azure AD Identity Protection is for cloud identities, not on-premises AD. Option D is wrong because the MDI sensor is already deployed on-premises; no need to deploy it in Azure.

Answer

Deploy the MDI sensor on an Azure VM to send data to Sentinel.

Answer

Integrate Microsoft Entra ID Protection with Sentinel instead.

Answer

Configure MDI to forward logs to a Syslog server, then use the Syslog connector in Sentinel.

Question 4

Your organization uses Azure SQL Database and needs to protect sensitive data from being exported by unauthorized users. You must implement a solution that prevents users from copying data to clipboard or taking screenshots of query results, while allowing legitimate business operations. What should you implement?

Accepted Answer

Configure a session policy in Microsoft Defender for Cloud Apps to block clipboard and screenshot actions.. Option C is correct because Microsoft Defender for Cloud Apps session policies can monitor and control data exfiltration via reverse proxy, including blocking clipboard and screenshot actions. Option A is incorrect because Azure SQL Database Auditing logs activities but does not prevent them. Option B is incorrect because Dynamic Data Masking obfuscates data but does not prevent export. Option D is incorrect because Azure Information Protection labels files but does not prevent clipboard actions in a browser.

Answer

Apply Azure Information Protection labels to the database.

Answer

Use Dynamic Data Masking to obscure sensitive columns.

Answer

Enable Azure SQL Database Auditing and threat detection.

Question 5

Your organization uses Azure SQL Database with Azure AD authentication. You need to ensure that database administrators (DBAs) can only perform management tasks from a specific Azure region and only during business hours. Which solution should you use?

Accepted Answer

Azure AD Conditional Access policies. Option A is correct because Conditional Access can enforce location and time restrictions for Azure AD authenticated users. Option B is wrong because Azure SQL Firewall rules filter by IP, not user identity. Option C is wrong because Azure Policy cannot enforce time-based access. Option D is wrong because Azure RBAC cannot enforce location or time.

Answer

Azure RBAC with custom roles

Answer

Azure Policy with custom policy

Answer

Azure SQL Database firewall rules

Question 6

Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You are designing a solution to protect against password spray attacks. You need to implement a solution that can detect and block malicious authentication attempts in real-time. What should you use?

Accepted Answer

Microsoft Entra ID Protection with Conditional Access policies.. Option A is correct because Entra ID Identity Protection provides real-time risk detection and conditional access policies to block risky sign-ins, including password spray. Option B is wrong because Microsoft Defender for Identity focuses on on-premises AD attacks, not cloud authentication. Option C is wrong because Azure AD MFA is a verification method, not a detection mechanism. Option D is wrong because password hash sync is for synchronization, not detection.

Answer

Microsoft Defender for Identity with a VPN integration.

Answer

Azure AD Multi-Factor Authentication (MFA) enforced for all users.

Answer

Password hash synchronization with Azure AD Connect.

Question 7

Your company is deploying Azure Kubernetes Service (AKS) and needs to secure container workloads. You must ensure that only approved container images from a trusted Azure Container Registry (ACR) can be deployed. What should you implement?

Accepted Answer

Apply an Azure Policy initiative to only allow images from a specific ACR.. Option C is correct because Azure Policy with the 'Only allow approved container images' built-in initiative enforces that containers in AKS must originate from a specified ACR. Option A is incorrect because network policies control traffic, not image source. Option B is incorrect because Azure AD integration controls authentication, not image source. Option D is incorrect because Azure Key Vault stores secrets, not image approval.

Answer

Enable Azure AD integration for AKS.

Answer

Use Azure Key Vault to store container image credentials.

Answer

Configure network policies in AKS to restrict egress traffic.

Question 8

Your company is planning to use Microsoft Intune for mobile device management (MDM). You need to ensure that devices are compliant before accessing corporate resources. Which TWO components should you configure?

Accepted Answer

Conditional Access policies in Microsoft Entra ID.. Option B is correct because compliance policies define the conditions for device compliance. Option D is correct because Conditional Access policies enforce access based on compliance. Option A is wrong because configuration policies are for settings, not compliance. Option C is wrong because app protection policies are for app-level, not device-level compliance. Option E is wrong because enrollment restrictions are for device enrollment, not compliance.

Answer

Device configuration policies.

Answer

Enrollment restrictions.

Answer

App protection policies.

Question 9

A company uses Microsoft Sentinel for SIEM and SOAR. You need to design a solution to detect and automatically respond to ransomware attacks involving mass file encryption on Windows servers. The response must include isolating the compromised server from the network, creating a backup of affected files, and resetting the user account's password. Which automation approach minimizes manual intervention?

Accepted Answer

Set up an automation rule that runs a playbook to isolate the VM, trigger a backup, and reset the user password.. Option D is correct because Microsoft Sentinel's automation rules can trigger a playbook (Logic App) that performs all three actions: isolate VM via Azure Automation runbook, trigger backup via Azure Backup APIs, and reset password via Microsoft Graph. Option A is incorrect because it only isolates. Option B is incorrect because it only creates backups. Option C is incorrect because it only resets the password.

Answer

Use a Logic Apps playbook to create a VM snapshot and send an email to the security team.

Answer

Create an alert rule that triggers an Azure Automation runbook to isolate the VM.

Answer

Configure a manual incident response plan that includes password reset.

Question 10

Your organization is implementing a defense-in-depth strategy for a multi-tier application hosted on Azure. You need to secure the network layers. Which THREE measures should you implement?

Accepted Answer

Enable Azure DDoS Protection on the virtual network.. Option B is correct because Azure Firewall provides centralized inbound and outbound traffic filtering. Option C is correct because network security groups (NSGs) provide micro-segmentation at the subnet or NIC level. Option D is correct because Azure DDoS Protection helps mitigate volumetric attacks. Option A is wrong because a VPN gateway is for connectivity, not a network security layer. Option E is wrong because Azure Front Door is an application delivery and security service, but it is not a general network security layer for all tiers; it is more specific to web applications.

Answer

Configure Azure Front Door to protect the application layer.

Answer

Deploy a site-to-site VPN gateway.

Question 11

Your organization uses Azure Kubernetes Service (AKS) for containerized workloads. You need to design a security solution that includes network segmentation, threat detection, and secret management. Which THREE Azure services should you include?

Accepted Answer

Azure Key Vault with CSI driver for secrets store. Option A (Azure Policy for AKS) enforces network policies and compliance. Option C (Azure Security Center for Kubernetes, now part of Defender for Cloud) provides threat detection. Option D (Azure Key Vault) stores secrets. Option B (Azure Firewall) is for perimeter, not AKS-specific; Option E (Azure Service Bus) is messaging.

Answer

Azure Service Bus

Answer

Azure Firewall Premium

Question 12

You are designing a backup strategy for Azure virtual machines that host a mission-critical application. The solution must support daily backups with a retention of 30 days for daily backups, weekly backups retained for 12 weeks, and monthly backups retained for 3 years. What should you use?

Accepted Answer

Azure Backup with a backup policy that specifies daily, weekly, and monthly retention.. Option A is correct because Azure Backup allows you to define backup policies with multiple retention points (daily, weekly, monthly, yearly). Option B is incorrect because Azure Site Recovery is for disaster recovery, not long-term retention. Option C is incorrect because Azure Disk Backup is for disk-level backups and does not support complex retention. Option D is incorrect because Azure Files backup is for file shares.

Answer

Azure Files backup with a custom script.

Answer

Azure Disk Backup with a snapshot schedule.

Answer

Azure Site Recovery with a recovery plan.

Question 13

Refer to the exhibit. You are reviewing an Azure Policy definition that is assigned to a subscription containing several virtual machines. After the assignment, users report that they cannot create new VMs. What is the most likely reason?

Accepted Answer

The policy denies creation of VMs that do not use managed disks.. Option A is correct because the policy denies creation of VMs that do not use managed disks. The condition checks if the osDisk.managedDisk field does not exist, and if so, denies the request. Therefore, any attempt to create a VM with unmanaged disks will be denied. Option B is wrong because the policy only denies creation, it does not affect existing VMs. Option C is wrong because the policy denies all VMs without managed disks, not just those with a specific size. Option D is wrong because the policy does not require premium SSDs; it only requires managed disks.

Answer

The policy denies creation of VMs with a specific size.

Answer

The policy denies creation of VMs that use managed disks.

Answer

The policy denies creation of VMs that do not use premium SSDs.

Question 14

Your company uses Microsoft Intune to manage Windows 10 devices. You need to design a security baseline that ensures devices meet the organization's security requirements, including BitLocker encryption, Windows Defender Firewall rules, and Microsoft Defender for Endpoint settings. Which TWO Intune features should you use to apply these configurations?

Accepted Answer

Endpoint security policies for Antivirus, Firewall, and Disk Encryption. Option A (Security Baselines) provides pre-configured settings for security features. Option D (Endpoint security policies) allows granular configuration for antivirus, firewall, and BitLocker. Option B (Compliance policies) enforce but not configure; Option C (Configuration profiles) can do settings but not as comprehensive; Option E (Device enrollment restrictions) are for enrollment control.

Answer

Device enrollment restrictions

Answer

Compliance policies for Windows 10

Answer

Custom configuration profiles using OMA-URI

Question 15

Your organization uses Microsoft Sentinel for security operations. You need to design a solution to detect and respond to lateral movement using pass-the-hash attacks. Which TWO data sources should you enable for ingestion into Microsoft Sentinel to detect such attacks?

Accepted Answer

Microsoft Defender for Identity alerts.. Correct answers: A and D. Windows Security Events (Event ID 4624) can show anomalous logons, and Microsoft Defender for Identity provides detection of pass-the-hash. Option B is incorrect: Azure AD sign-in logs do not capture on-prem NTLM events. Option C is incorrect: Sysmon is helpful but not specifically for pass-the-hash. Option E is incorrect: DNS logs are for network anomalies.

Answer

DNS events from DNS servers.

Answer

Azure AD sign-in logs.

Answer

Sysmon logs for process creation.

SC-100 Practice Test 39 — 15 Questions

Exhibit

SC-100 Practice Test 39 — 15 Questions

Exhibit