SC-100 Practice Test 41 — 15 Questions

Question 1

Your organization is deploying a new line-of-business application on Azure App Service. The app must authenticate users from Microsoft Entra ID and also access a downstream API that requires a client secret. You need to recommend the most secure method for managing the client secret. What should you use?

Accepted Answer

Store the secret in Azure Key Vault and use a Key Vault reference in App Service.. Option C is correct because Azure Key Vault provides secure storage for secrets and certificates, and App Service can reference them via managed identity or Key Vault references. Option A is wrong because storing the secret in code exposes it to source control and accidental disclosure. Option B is wrong because App Service application settings are less secure and can be accessed through the portal. Option D is wrong because Azure AD app registration is the identity object, not a storage for secrets.

Answer

Store the secret in the Azure AD app registration manifest.

Answer

Store the secret in an App Service application setting.

Answer

Store the secret in the application code as a constant.

Question 2

Your company uses Microsoft Defender for Cloud to protect Azure resources. A critical application uses an Azure SQL Database. You need to ensure that all queries to the database are encrypted in transit and that the encryption protocol is the most secure version available. Which configuration should you enforce?

Accepted Answer

Set the minimal TLS version to 1.2 in the server's firewall rules.. Option B is correct because Azure SQL Database supports TLS 1.2 by default and can be enforced via server-level firewall rules or connection policy. Option A is wrong because TCP is a transport protocol, not encryption. Option C is wrong because forcing SSL only ensures encryption but may allow older TLS versions. Option D is wrong because encrypted connections are not the default for all clients; you must enforce minimal TLS version.

Answer

Configure the database to reject unencrypted connections.

Answer

Set the connection policy to Proxy and force TCP.

Answer

Enable 'Force SSL' on the database.

Question 3

Your company is using Microsoft Defender for Cloud to protect Azure resources. You need to implement just-in-time (JIT) VM access. Which THREE components are required? (Choose THREE.)

Accepted Answer

Microsoft Defender for Cloud enabled at the subscription level.. Options A, B, and E are required. JIT requires a VM with a network security group (NSG), enabling JIT in Defender for Cloud, and assigning permissions to request access. Option C is wrong because an Azure Bastion host is optional. Option D is wrong because a Log Analytics workspace is not required.

Answer

Log Analytics workspace for storing access logs.

Answer

Azure Bastion host for secure RDP/SSH access.

Question 4

Your organization stores sensitive customer data in Azure Blob Storage. You need to implement data classification and labeling using Microsoft Purview. Which resource should you use to automatically scan and classify the data?

Accepted Answer

Microsoft Purview Data Map. Option A is correct because Microsoft Purview Data Map provides automated scanning and classification of data assets across Azure and on-premises. Option B is wrong because Purview Information Protection focuses on labeling and protection policies, not scanning. Option C is wrong because Purview Data Loss Prevention (DLP) monitors and prevents data exfiltration. Option D is wrong because Azure Policy enforces organizational standards, not data classification.

Answer

Azure Policy

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Loss Prevention

Question 5

A company uses Microsoft Entra ID to authenticate users for a web application. They want to enable self-service password reset (SSPR) for users. What is the minimum licensing requirement?

Accepted Answer

Microsoft Entra ID P1. Option B is correct because Microsoft Entra ID P1 includes SSPR with writeback to on-premises Active Directory. Option A is wrong because the free tier does not include SSPR. Option C is wrong because P2 adds Identity Protection, not required for basic SSPR. Option D is wrong because Microsoft 365 E3 includes Entra ID P1, but the question asks for minimum licensing.

Answer

Microsoft 365 E3

Answer

Microsoft Entra ID P2

Answer

Microsoft Entra ID Free

Question 6

Your organization uses Microsoft Defender for Cloud to protect Azure SQL databases. You notice that a particular database is flagged with a high-severity recommendation to enable 'Advanced Data Security'. What does enabling Advanced Data Security provide?

Accepted Answer

It provides vulnerability assessments and threat detection.. Option C is correct because Advanced Data Security (ADS) includes vulnerability assessments, threat detection, and data discovery/classification. Option A is wrong because transparent data encryption (TDE) is a separate feature. Option B is wrong because ADS does not restrict network access; that is firewall or VNet rules. Option D is wrong because backup encryption is handled by Azure Storage encryption.

Answer

It restricts access to the database to specific IP addresses.

Answer

It encrypts the database at rest using TDE.

Answer

It enables automatic backup encryption.

Question 7

Your company is designing a solution to store sensitive documents in Azure Files. The files must be encrypted at rest and in transit. Which two configurations are required? (Each correct answer presents part of the solution.)

Accepted Answer

Enable Azure Storage Service Encryption (SSE) for the storage account.. Option A and B are correct. Encryption at rest is provided by Azure Storage Service Encryption (SSE). Encryption in transit is provided by SMB 3.0 with encryption. Option C is wrong because Azure File Sync does not provide encryption at rest or in transit for the file share itself. Option D is wrong because Azure Disk Encryption is for VMs, not Azure Files. Option E is wrong because TLS is for HTTPS, not SMB.

Answer

Enable Azure Disk Encryption on the VMs that mount the share.

Answer

Configure the storage account to use HTTPS only.

Answer

Use Azure File Sync to sync files to on-premises servers.

Question 8

Your organization uses Microsoft Purview Information Protection to label and protect sensitive emails and documents. You need to ensure that when a user applies a 'Highly Confidential' label, the content is automatically encrypted and a watermark is added. Which configuration should you use?

Accepted Answer

Configure a sensitivity label with encryption and watermark settings.. Option B is correct because a label with protection settings can enforce encryption and apply a watermark. Option A is wrong because the label itself can be configured, not requiring a separate policy. Option C is wrong because DLP policies prevent sharing but do not add watermarks. Option D is wrong because Azure Information Protection is the underlying technology, but the configuration is done via sensitivity labels.

Answer

Use Azure Information Protection scanner to apply labels automatically.

Answer

Create a DLP policy that blocks sharing of highly confidential content.

Answer

Enable Microsoft 365 Message Encryption for all emails.

Question 9

A company uses Azure API Management to expose backend APIs. They need to implement OAuth 2.0 authorization with Microsoft Entra ID. The APIs are called by a SPA application. Which OAuth 2.0 grant type should be used?

Accepted Answer

Authorization code flow with PKCE. Option C is correct because the authorization code flow with PKCE is the recommended grant for SPAs. Option A is wrong because implicit flow is deprecated due to security concerns. Option B is wrong because client credentials is for server-to-server, not user authentication. Option D is wrong because resource owner password credentials (ROPC) is not recommended and requires user credentials.

Answer

Implicit grant

Answer

Resource owner password credentials grant

Answer

Client credentials grant

Question 10

Your organization is planning to use Microsoft Sentinel for security information and event management (SIEM). You need to ingest security logs from on-premises Active Directory. What should you deploy?

Accepted Answer

Azure Monitor Agent. Option A is correct because Azure Monitor Agent is the current agent for collecting Windows events from on-premises VMs and sending to Log Analytics workspace, which is used by Sentinel. Option B is wrong because Log Analytics agent is legacy. Option C is wrong because MMA is also legacy. Option D is wrong because Defender for Cloud agent focuses on security baselines, not general event collection.

Answer

Microsoft Monitoring Agent (MMA)

Answer

Log Analytics agent

Answer

Microsoft Defender for Cloud agent

Question 11

Your company is developing a microservices application that will run on Azure Kubernetes Service (AKS). The application must authenticate to Azure SQL Database using managed identities. Which type of managed identity should you assign to the AKS cluster?

Accepted Answer

User-assigned managed identity and Azure AD Pod Identity. Option B is correct because AKS uses a system-assigned managed identity for the cluster itself to integrate with Azure resources like load balancers. For pods to access Azure SQL, you need a pod identity (like Azure AD Pod Identity) which uses a user-assigned managed identity. Option A is wrong because system-assigned is for cluster, not pods. Option C is wrong because service principal is legacy. Option D is wrong because certificate-based authentication is not managed identity.

Answer

Certificate-based authentication using Azure Key Vault

Answer

System-assigned managed identity on the cluster

Answer

Service principal with client secret

Question 12

Your organization uses Azure Data Lake Storage Gen2 for big data analytics. You need to secure access to the data using Azure RBAC and ACLs. Which two methods can you use to authorize access? (Choose two.)

Accepted Answer

Assign Azure RBAC roles such as Storage Blob Data Contributor to security principals.. Options A and B are correct. Azure RBAC roles (e.g., Storage Blob Data Contributor) provide coarse-grained access. POSIX-like ACLs provide fine-grained access at directory/file level. Option C is wrong because SAS tokens provide delegated access but not RBAC/ACL. Option D is wrong because managed identity is an identity, not an authorization method. Option E is wrong because firewall rules control network access.

Answer

Configure IP firewall rules to restrict access.

Answer

Use managed identities for Azure resources.

Answer

Generate shared access signatures (SAS) for delegated access.

Question 13

Your organization uses Azure Cosmos DB with SQL API. You need to implement data encryption at rest and control access to the encryption keys. Which two actions should you take? (Choose two.)

Accepted Answer

Configure a customer-managed key in Azure Key Vault for encryption.. Options A and B are correct. Option A: Enable server-side encryption (SSE) which is enabled by default but explicitly ensuring it's on is good. Option B: Use customer-managed keys (CMK) stored in Azure Key Vault for key control. Option C is wrong because client-side encryption is not the same as at-rest encryption and adds complexity. Option D is wrong because Azure Disk Encryption is for VMs. Option E is wrong because Data Encryption at rest is not turned off by default in Cosmos DB; it's always on.

Answer

Implement client-side encryption using the .NET SDK.

Answer

Enable Azure Disk Encryption on the VMs that access Cosmos DB.

Answer

Turn off automatic encryption and use a custom encryption algorithm.

Question 14

You are designing a secure DevOps pipeline using GitHub Actions and Azure. The security team requires that all container images pushed to Azure Container Registry (ACR) are scanned for vulnerabilities before deployment. If critical vulnerabilities are found, the pipeline must fail. What should you integrate into the pipeline?

Accepted Answer

Integrate Microsoft Defender for Cloud with Azure Container Registry scanning and configure a GitHub Actions step to check scan results. Option A is correct because Microsoft Defender for Cloud can scan container images in ACR for vulnerabilities and integrate with GitHub Actions to fail the pipeline on critical findings. Option B is wrong because Azure Security Center is now part of Defender for Cloud. Option C is wrong because Azure Policy can enforce compliance but not scan images. Option D is wrong because Azure Bastion is for secure remote access.

Answer

Configure Azure Policy to require image scanning before deployment

Answer

Deploy Azure Bastion to scan images during build

Answer

Use Azure Security Center (legacy) to scan images on push

Question 15

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

Retrieve details of security alerts named 'Suspicious process execution' from the last hour. Option A is correct because the query filters alerts with a specific name and time range, then projects selected fields. Option B is wrong because it does not aggregate. Option C is wrong because it does not join tables. Option D is wrong because it does not create a new rule.

Answer

Count the number of 'Suspicious process execution' alerts in the last hour

Answer

Join the SecurityAlert table with another table to enrich the results

Answer

Create an analytics rule to detect 'Suspicious process execution'