SC-100 Practice Test 42 — 15 Questions

Question 1

Your organization stores sensitive data in Azure Blob Storage. You need to ensure that data is encrypted at rest and that the encryption keys are rotated every 90 days. You also need to maintain your own key material. Which solution should you use?

Accepted Answer

Azure Storage Service Encryption with customer-managed keys in Azure Key Vault. Azure Storage encryption with customer-managed keys in Azure Key Vault allows you to supply your own encryption keys and rotate them on your own schedule. Option A is wrong because Azure Disk Encryption is for VM disks, not Blob Storage. Option B is wrong because Azure Storage Service Encryption with Microsoft-managed keys does not allow customer control or rotation. Option D is wrong because Azure Information Protection is for classification and labeling, not encryption at rest.

Answer

Azure Information Protection

Answer

Azure Storage Service Encryption with Microsoft-managed keys

Answer

Azure Disk Encryption

Question 2

Your company uses Microsoft Intune to manage mobile devices. You need to protect corporate data on mobile devices by ensuring that work files are encrypted and not accessible by personal apps. What three configurations should you implement? (Choose three.)

Accepted Answer

Enable mobile threat defense (MTD) integration to block risky devices.. Options A, B, and C are correct. App protection policies (MAM) prevent data from being copied to personal apps. Conditional Access with 'Require app protection policy' ensures managed apps are used. Mobile threat defense integration adds security. Option D is wrong because device encryption is device-level, not app-level. Option E is wrong because compliance policies are for device compliance, not data protection on unmanaged devices.

Answer

Require device encryption on all devices.

Answer

Deploy a device compliance policy that requires a PIN.

Question 3

Refer to the exhibit. You are reviewing an Azure Policy definition that uses a 'modify' effect. The policy is intended to automatically enable transparent data encryption (TDE) on Azure SQL databases after they are created. Which condition must be met for the modify effect to work?

Accepted Answer

A managed identity must be associated with the policy assignment and have permissions to modify TDE.. Option D is correct because the modify effect requires a managed identity with the appropriate role (e.g., SQL DB Contributor) to perform the remediation. Option A is wrong because the modify effect does not require a specific SKU. Option B is wrong because the policy can be applied at any scope, including subscription. Option C is wrong because TDE can be enabled on any database, not just new ones.

Answer

The policy must be assigned at the management group scope.

Answer

The database must be newly created.

Answer

The SQL database must be using the General Purpose service tier.

Question 4

Your company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. You need to prevent users from sharing credit card numbers via email in Outlook on the web. The policy should notify users when they try to send such data and allow them to override with a business justification. What should you configure?

Accepted Answer

Create a DLP policy with the action 'Block with override' and enable 'Business justification'. Option C is correct because DLP policies can have rules that detect sensitive info types like credit card numbers, and the action 'Block with override' allows users to override with justification. Option A is wrong because 'Block' without override is too restrictive. Option B is wrong because 'Audit only' does not block. Option D is wrong because encryption alone does not block.

Answer

Create a DLP policy with the action 'Audit only' for credit card numbers

Answer

Create a DLP policy that encrypts emails containing credit card numbers

Answer

Create a DLP policy with the action 'Block' for credit card numbers

Question 5

Your organization uses Microsoft Defender for Cloud Apps. You need to detect and prevent the use of unsanctioned cloud apps. The solution should generate alerts when users access high-risk apps and block access to very high-risk apps. Which three actions should you take? (Choose three.)

Accepted Answer

Unsanction high-risk apps using the app catalog. Options A, C, and D are correct because to detect and block unsanctioned apps, you need to discover them via Cloud Discovery, sanction or unsanction them, and create policies to block unsanctioned apps. Option B is wrong because Conditional Access policies are for identity, not app blocking. Option E is wrong because DLP policies are for data protection, not app control.

Answer

Configure Conditional Access policies in Microsoft Entra ID to block unsanctioned apps

Answer

Create a DLP policy to prevent data upload to unsanctioned apps

Question 6

Refer to the exhibit. You are analyzing sign-in failures in Microsoft Sentinel using a KQL query. What does this query identify?

Accepted Answer

Accounts that had more than 10 failed logon attempts in the last 7 days.. Option B is correct because the query filters EventID 4625 (failed logon) and groups by Account and Computer, then filters accounts with more than 10 failures in the last 7 days. Option A is wrong because it does not show success events. Option C is wrong because it does not group by IP address. Option D is wrong because it does not include locked accounts.

Answer

Accounts that have been locked out due to multiple failures.

Answer

Computers with more than 10 login attempts from the same IP address.

Answer

Accounts that successfully logged in more than 10 times.

Question 7

Your organization uses Microsoft Defender for Cloud to protect Azure resources. You need to ensure that only authorized applications can access Azure Key Vault secrets. The solution must use managed identities and least privilege. What should you configure?

Accepted Answer

Assign a system-assigned managed identity to the application and grant it Key Vault Secrets User role. Option C is correct because using a system-assigned managed identity and assigning Key Vault access policies with Get and List permissions provides secure, identity-based access with least privilege. Option A is wrong because enabling public network access increases the attack surface. Option B is wrong because shared access signature tokens are less secure and harder to manage. Option D is wrong because certificate-based authentication adds complexity without managed identity benefits.

Answer

Use a shared access signature (SAS) token stored in an environment variable

Answer

Enable public network access on Key Vault and restrict inbound IP addresses

Answer

Install a client certificate on the application server and use it to authenticate to Key Vault

Question 8

Refer to the exhibit. A security architect is reviewing an ARM template for an Azure Key Vault. The vault must be accessible from a backend subnet via private endpoint. What is the missing configuration component?

Accepted Answer

Add a Microsoft.Network/privateEndpoints resource and a private DNS zone. The exhibit shows network ACLs with virtual network rules, but to use private endpoints, the template must include a private endpoint resource and a private DNS zone. Option B is correct because private endpoints are required for private connectivity, and they are not part of the vault resource itself. Option A is wrong because enabling RBAC authorization is not required for private endpoint access. Option C is wrong because disabling public network access is done via the network ACLs, but private endpoints still need a separate resource. Option D is wrong because a system-assigned managed identity is not needed for private endpoint connectivity.

Answer

Enable RBAC authorization on the vault

Answer

Assign a system-assigned managed identity to the vault

Answer

Set the defaultAction to Allow for the network ACLs

Question 9

You are designing a data classification strategy for Microsoft Purview. The compliance team requires that documents containing personally identifiable information (PII) like credit card numbers are automatically labeled and encrypted when stored in Microsoft SharePoint Online. The solution must use built-in sensitive information types. What should you include in the design?

Accepted Answer

Create a sensitivity label with auto-labeling for credit card numbers and enable encryption. Option D is correct because a sensitivity label with auto-labeling for content matching a sensitive information type (like credit card number) and encryption can be applied to SharePoint documents automatically. Option A is wrong because retention labels do not enforce encryption. Option B is wrong because trainable classifiers require custom training. Option C is wrong because manual labeling is not automatic.

Answer

Create a retention label and apply it automatically via a data loss prevention (DLP) policy

Answer

Use a trainable classifier to detect PII and apply a sensitivity label

Answer

Configure a manual sensitivity label policy for users to apply

Question 10

A company stores sensitive customer data in Azure SQL Database. They need to encrypt the data at rest and control access to encryption keys. Which solution should they use?

Accepted Answer

Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault. Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault provides at-rest encryption and allows the customer to control the encryption keys. Option A is wrong because Dynamic Data Masking hides data from non-privileged users but does not encrypt at rest. Option B is wrong because Always Encrypted encrypts data in use and at rest, but TDE is the standard for at-rest encryption. Option D is wrong because Azure Information Protection is for classification and labeling, not database encryption.

Answer

Azure Information Protection

Answer

Always Encrypted

Answer

Dynamic Data Masking

Question 11

Your company uses Microsoft Defender for Cloud Apps to discover and control shadow IT. You need to block the use of a newly discovered unsanctioned cloud storage app that poses a high risk. What should you configure?

Accepted Answer

In Defender for Cloud Apps, unsanction the app and create a session policy to block it. Option A is correct because Defender for Cloud Apps allows you to sanction/unsanction apps and create access policies to block unsanctioned apps. Option B is wrong because Conditional Access policies in Entra ID control access but not app blocking. Option C is wrong because Intune compliance policies manage device compliance. Option D is wrong because Defender for Cloud Apps can block apps directly.

Answer

Create a Conditional Access policy in Microsoft Entra ID to block the app

Answer

Use Microsoft Intune to set a compliance policy that blocks the app

Answer

Add the app to the blocked list in Microsoft Defender for Cloud Apps

Question 12

Your organization is using Microsoft Sentinel for security information and event management (SIEM). You need to ensure that data from Azure Activity Logs is ingested into Sentinel. What should you configure?

Accepted Answer

Connect Azure Activity Logs via the Microsoft Sentinel data connector. Option D is correct because you can connect Azure Activity Logs as a data connector in Microsoft Sentinel. Option A is wrong because Log Analytics workspace is the underlying storage, but the connection is made via data connectors. Option B is wrong because Azure Policy can enforce configuration but not directly ingest logs. Option C is wrong because Azure Monitor is a broader service; the specific connector is needed.

Answer

Configure a Log Analytics workspace to collect Activity Logs

Answer

Use Azure Policy to stream Activity Logs to Sentinel

Answer

Enable Azure Monitor to forward Activity Logs to Sentinel

Question 13

A company deploys a line-of-business application on Azure App Service. The application uses a managed identity to access Azure SQL Database. Security policy requires that the database connection string must not contain credentials. How should the connection string be configured?

Accepted Answer

Use a managed identity and set the connection string to use Active Directory Managed Identity authentication without credentials. Using a managed identity, the connection string can be set to use 'Authentication=Active Directory Managed Identity' without any username or password. Option A is wrong because the connection string should not include credentials. Option B is wrong because Key Vault references are used for secrets, but managed identity itself avoids the need for a secret. Option D is wrong because connection strings are not stored in App Service as secrets.

Answer

Store the connection string in App Service application settings with the password encrypted by App Service

Answer

Store the connection string with username and password in Key Vault and reference it in App Settings

Answer

Store the connection string as a secret in Azure Key Vault and use a Key Vault reference in App Settings

Question 14

You are designing an API management solution using Azure API Management. The security team requires that all API calls must be authenticated using OAuth 2.0 and that only specific Azure AD applications can access the APIs. Additionally, the solution must support rate limiting and IP filtering. What should you configure?

Accepted Answer

Configure OAuth 2.0 in Azure API Management, use validate-jwt policy to restrict to specific Azure AD apps, and add rate-limit and ip-filter policies. Option B is correct because Azure API Management can validate OAuth tokens, and you can restrict access to specific Azure AD applications using the 'validate-jwt' policy. Rate limiting and IP filtering are also built-in policies. Option A is wrong because it's not a complete solution. Option C is wrong because API keys are less secure. Option D is wrong because client certificates are not OAuth.

Answer

Set up client certificate authentication and map certificates to Azure AD apps

Answer

Enable API key authentication and restrict access using subscription keys

Answer

Use OAuth 2.0 with Azure AD and configure inbound policies to validate JWTs

Question 15

Refer to the exhibit. You are reviewing an Azure Policy definition. What does this policy do?

Accepted Answer

Denies creation of virtual machines that do not have a network interface attached. Option C is correct because the policy denies the creation of a virtual machine if the networkProfile.networkInterfaces field does not exist, meaning no NIC is attached. Option A is wrong because it denies creation, not deletes. Option B is wrong because it checks for NIC existence, not specific settings. Option D is wrong because it checks at creation time.

Answer

Audits virtual machines that have a network interface

Answer

Deletes virtual machines that do not have a network interface

Answer

Denies creation of virtual machines that have a network interface