SC-100 Practice Test 43 — 15 Questions

Question 1

Refer to the exhibit. A security architect is reviewing a Microsoft Purview sensitivity label configuration for a financial services company. The compliance team requires that employees must provide justification when downgrading a document labeled 'Confidential - Financial' to 'General'. Which configuration is missing?

Accepted Answer

Configure the sublabel's protection settings to require justification for downgrade. The exhibit shows a sensitivity label hierarchy but does not include any marking or protection settings. To require justification for downgrading, the label must have a conditional access policy or auto-labeling policy configured, specifically a 'justification on downgrade' setting. Option B is correct because justification is configured as part of the label's protection settings. Option A is wrong because auto-labeling is for automatic application, not downgrade control. Option C is wrong because label analytics is for reporting, not enforcement. Option D is wrong because the sublabel itself does not enforce justification.

Answer

Create a new sublabel under 'General' to match the hierarchy

Answer

Configure auto-labeling for the sublabel

Answer

Enable label analytics in Purview

Question 2

Your organization uses Microsoft Defender for Endpoint (MDE) for endpoint detection and response. You need to protect sensitive data on Windows 10 devices from being exfiltrated via USB drives. The solution must be able to audit file copy operations to USB and block them for high-risk users. What should you configure?

Accepted Answer

Deploy a device control policy in Microsoft Defender for Endpoint to audit USB usage and block for high-risk users. Option D is correct because Microsoft Defender for Endpoint includes device control features that can audit and block removable storage. You can configure policies to audit all users and block for high-risk users using custom device control policies. Option A is wrong because Intune can manage USB restrictions but not with MDE-specific auditing. Option B is wrong because DLP policies in Microsoft Purview are for cloud and network. Option C is wrong because conditional access does not control USB.

Answer

Set up a Conditional Access policy in Microsoft Entra ID to block sign-ins from devices with USB activity

Answer

Use Microsoft Intune to create a device configuration profile that disables USB ports

Answer

Configure a Microsoft Purview DLP policy for endpoint devices

Question 3

Refer to the exhibit. You run the PowerShell command shown in the exhibit. The command returns the secret value in plain text. The Key Vault has soft-delete and purge protection enabled. What is the most likely reason that the command succeeded?

Accepted Answer

The user has the 'Key Vault Secrets User' role assigned via RBAC. Option B is correct because the user running the command has the 'Key Vault Secrets User' role assigned, which includes the 'Microsoft.KeyVault/vaults/secrets/read' permission, allowing retrieval of secret values. Option A is wrong because the 'Secret Management' role in IAM does not exist. Option C is wrong because access policies are still used; the command uses the caller's identity. Option D is wrong because managed identity is not mentioned.

Answer

The Key Vault access policy allows the user to list secrets

Answer

The user has the 'Key Vault Secret Management' role in Azure RBAC

Answer

The command was executed using the Key Vault managed identity

Question 4

Your organization is designing a data protection strategy using Microsoft Purview. You need to classify and label all sensitive data stored in Azure SQL Database. The solution must automatically detect credit card numbers and apply a sensitivity label. Which three actions should you take? (Choose three.)

Accepted Answer

Create a scan in Purview to classify sensitive data types. Options B, C, and D are correct because to automatically classify and label data in Azure SQL Database, you need to register the data source in Purview, scan it to discover sensitive data, and create an auto-labeling policy that applies the label. Option A is wrong because DLP policies are for data in use/motion, not for labeling. Option E is wrong because enabling auditing does not classify or label.

Answer

Enable Azure SQL Database auditing

Answer

Create a data loss prevention (DLP) policy in Purview

Question 5

A company uses Microsoft Entra ID for identity management. They want to ensure that only approved users can access a custom web application. The solution must support single sign-on (SSO) and require multi-factor authentication (MFA) for external users. Which approach should they use?

Accepted Answer

Configure Microsoft Entra B2B collaboration and set MFA trust settings. Registering the application in Microsoft Entra ID and configuring Conditional Access policies to require MFA for external users provides SSO and MFA enforcement. Option A is wrong because SAML sign-on alone does not enforce MFA. Option B is wrong because app roles manage authorization, not authentication requirements. Option C is wrong because B2B collaboration handles identity, but MFA is enforced through Conditional Access, not solely through B2B settings.

Answer

Register the application in Microsoft Entra ID and configure SAML-based sign-on

Answer

Use Azure AD Application Proxy to publish the app

Answer

Register the application in Microsoft Entra ID and assign app roles

Question 6

Refer to the exhibit. A security analyst is reviewing a Windows security event log from a domain controller. The event indicates an attempted logon failure. Which type of attack is most likely being attempted?

Accepted Answer

Brute-force password guessing attack. Event 4625 is a failed logon attempt. Logon Type 3 (Network) and the target account 'admin' with failure reason 'Unknown user name or bad password' suggest a brute-force or password guessing attack against a privileged account. Option B is correct because the event shows attempts to guess the 'admin' account password over the network. Option A is wrong because a pass-the-hash attack would use a different logon type and process. Option C is wrong because a Kerberos golden ticket attack would not show a logon type 3 failure. Option D is wrong because DCSync would generate different events (4662).

Answer

Kerberos golden ticket attack

Answer

DCSync attack

Answer

Pass-the-hash attack

Question 7

You are designing a secure access strategy for Azure App Service web applications. The requirements are: use Azure AD for authentication, restrict access to specific IP ranges, and require multi-factor authentication (MFA) for all users. Which two components should you configure? (Choose two.)

Accepted Answer

Configure Azure App Service authentication with Microsoft Entra ID. Options B and C are correct because Azure App Service authentication can be configured to use Azure AD, and Conditional Access policies can enforce MFA and IP restrictions. Option A is wrong because app registration is part of the setup but not a direct component for access control. Option D is wrong because network security groups are for virtual networks, not App Service. Option E is wrong because Azure Firewall is for network traffic, not user authentication.

Answer

Apply a network security group (NSG) to the App Service subnet

Answer

Deploy Azure Firewall to filter inbound traffic

Answer

Register the application in Microsoft Entra ID

Question 8

A company uses Microsoft Defender for Cloud Apps to control data exfiltration from sanctioned SaaS apps. Security admins want to block downloading sensitive files from SharePoint Online to unmanaged devices. Which method should be used?

Accepted Answer

Create a session policy in Defender for Cloud Apps that checks for device tags and blocks download. Session policy with device tag check is the correct approach because Defender for Cloud Apps can inspect device tags during a session and block downloads if the device is unmanaged. Option A is wrong because Conditional Access App Control is the underlying framework, not a specific policy type. Option B is wrong because DLP policies in Purview are for classification, not real-time blocking in apps. Option D is wrong because compliance policies are for device compliance, not session-level control.

Answer

Create a Conditional Access App Control session policy

Answer

Create a Microsoft Purview Data Loss Prevention policy for SharePoint

Answer

Create a Microsoft Intune compliance policy to block unmanaged devices

Question 9

A company is designing a security solution for a new application that will be deployed on Azure Kubernetes Service (AKS). They need to protect secrets and ensure that only authorized pods can access them. Which TWO actions should they take? (Choose two.)

Accepted Answer

Enable pod identity to assign managed identities to pods for Key Vault access. Using Azure Key Vault Provider for Secrets Store CSI Driver (Option A) allows pods to mount secrets from Key Vault. Enabling pod identity with managed identity (Option C) ensures that only authorized pods can access Key Vault. Option B is wrong because storing secrets in ConfigMaps is not secure. Option D is wrong because Azure Disk Encryption does not apply to secrets. Option E is wrong because Network Policies control traffic, not secrets access.

Answer

Configure network policies to restrict pod-to-pod traffic

Answer

Store secrets in Kubernetes ConfigMaps

Answer

Enable Azure Disk Encryption for AKS nodes

Question 10

A company is implementing Microsoft Purview to protect sensitive data in Microsoft 365. They need to prevent users from sharing credit card numbers via email. Which THREE components must be configured? (Choose three.)

Accepted Answer

Create a sensitive info type for credit card numbers. A sensitive info type for credit card numbers (Option A) is needed to detect the data. A DLP policy (Option C) enforces the rule. A policy tip (Option E) notifies users about the policy. Option B is wrong because retention labels are for retention, not prevention. Option D is wrong because auto-labeling applies labels, but DLP policies are needed to block sharing.

Answer

Create an auto-labeling policy for credit card data

Answer

Create a retention label for credit card data

Question 11

A company uses Microsoft Defender for Cloud to secure their Azure workloads. They need to ensure that all Azure SQL databases have threat detection enabled. Which TWO actions should they take? (Choose two.)

Accepted Answer

Enable Microsoft Defender for Cloud's 'SQL servers on machines' plan. Enabling Azure Defender for SQL at the subscription level (Option A) automatically enables threat detection for all SQL databases. Option C is correct because Defender for Cloud can enable Microsoft Defender for SQL as a plan. Option B is wrong because enabling individual audit policies is not necessary for threat detection. Option D is wrong because Advanced Threat Protection is part of the Azure SQL security settings, but the plan is enabled at the subscription level. Option E is wrong because vulnerability assessment is a separate feature.

Answer

Configure SQL Vulnerability Assessment

Answer

Enable Advanced Threat Protection on each SQL server individually

Answer

Configure SQL auditing on each database

Question 12

Refer to the exhibit. A security architect is reviewing an Azure Policy definition. What is the effect of this policy?

Accepted Answer

Denies creation or update of storage accounts that do not require HTTPS traffic. The policy checks if the resource type is a storage account and if HTTPS traffic only is set to false. If both conditions are true, it denies the creation or update of the storage account. Option B is correct because the effect is 'deny'. Option A is wrong because it does not audit; it denies. Option C is wrong because it does not modify; it denies. Option D is wrong because it does not deploy a remediation task.

Answer

Modifies storage accounts to enable HTTPS traffic only

Answer

Audits storage accounts that do not require HTTPS traffic

Answer

Deploys a remediation task to enable HTTPS traffic only

Question 13

A company uses Microsoft Sentinel for SIEM. They need to ensure that security events from Azure Active Directory (now Microsoft Entra ID) are ingested into Sentinel. Which data connector should they enable?

Accepted Answer

Microsoft Entra ID connector. The Microsoft Entra ID connector (Option B) is the correct data source for ingesting sign-in logs and audit logs from Entra ID. Option A is wrong because the Office 365 connector ingests data from Exchange, SharePoint, etc. Option C is wrong because the Azure Activity connector ingests subscription-level events. Option D is wrong because the Microsoft Defender XDR connector ingests alerts from Defender products.

Answer

Office 365 connector

Answer

Azure Activity connector

Answer

Microsoft Defender XDR connector

Question 14

Your team develops a web application hosted on Azure App Service. You need to secure the application against common web vulnerabilities like SQL injection and cross-site scripting. What should you implement?

Accepted Answer

Enable Azure Web Application Firewall (WAF) on Azure Front Door or Application Gateway.. Option C is correct because Azure Web Application Firewall (WAF) on Azure Front Door or Application Gateway protects against OWASP Top 10 threats including SQL injection and XSS. Option A is wrong because NSGs protect network traffic, not application layer. Option B is wrong because Key Vault is for secrets. Option D is wrong because DDoS protection is for network layer attacks.

Answer

Store application secrets in Azure Key Vault and enable managed identity.

Answer

Configure Network Security Groups (NSGs) on the App Service subnet to restrict inbound traffic.

Answer

Enable Azure DDoS Protection on the virtual network.

Question 15

Refer to the exhibit. A security architect is reviewing the network configuration of an Azure App Service app named 'finance-app'. The app needs to be accessible from a backend subnet via private endpoint. Which additional configuration is required?

Accepted Answer

Create a private endpoint and associate it with the App Service. The exhibit shows network ACLs with a virtual network rule allowing traffic from a subnet. However, to use private endpoint, the app must be integrated with a private endpoint resource. The 'publicNetworkAccess' is disabled, but private endpoint access requires a private endpoint resource to be created and associated with the app. Option A is correct. Option B is wrong because IP-based SSL is unrelated to network access. Option C is wrong because a regional VNet integration provides outbound connectivity, not inbound private access. Option D is wrong because enabling public access would defeat the purpose of private endpoint.

Answer

Set publicNetworkAccess to Enabled

Answer

Configure regional VNet integration for the app

Answer

Enable IP-based SSL for the app

SC-100 Practice Test 43 — 15 Questions

Exhibit

SC-100 Practice Test 43 — 15 Questions

Exhibit