SC-100 Practice Test 43 — 15 Questions

Question 1

A company uses Microsoft Purview to classify data and enforce retention policies. They need to automatically apply a retention label to all documents containing credit card numbers. Which approach should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an auto-labeling policy with a sensitive info type. Microsoft Purview auto-labeling policies can automatically apply retention labels to documents based on sensitive info types (SITs), such as credit card numbers. This approach uses pattern matching to detect the credit card number format and applies the label without user intervention, meeting the requirement for automatic enforcement.

Answer

Use a trainable classifier

Answer

Create a manual labeling policy for users

Answer

Use a default label for SharePoint libraries

Question 2

You are a security architect for a software development company. The company uses GitHub for source control and Azure DevOps for CI/CD. They have a large number of repositories and want to ensure that secrets (e.g., API keys, connection strings) are never committed to code. They also want to scan pull requests for secrets before merging. The company has Microsoft Defender for Cloud and Microsoft Purview available. You need to design a solution that prevents secret leaks. What should you use?

Accepted Answer

Enable GitHub secret scanning for all repositories. Configure push protection to block commits containing secrets. Use custom patterns to scan for company-specific secrets.. GitHub secret scanning can scan repositories for known secret patterns and supports custom patterns for company-specific secrets. Push protection blocks commits containing secrets before they are pushed. Option A is incorrect because Microsoft Defender for Cloud does not provide built-in secret scanning for GitHub repositories; GitHub secret scanning is a separate feature. Option B is incorrect because Azure Key Vault stores secrets but does not scan code for secrets. Option C is incorrect because Microsoft Purview Information Protection is for data classification and labeling, not for secret scanning in source code.

Answer

Enable Microsoft Defender for Cloud's 'Secrets scanning' feature for GitHub repositories.

Answer

Use Azure Key Vault to store secrets and enforce policies that require developers to use Key Vault references.

Answer

Use Microsoft Purview Information Protection to scan repositories and classify secrets.

Question 3

A financial services company is designing a security strategy for its Azure SQL Database. The database contains sensitive financial data. The company requires that all connections to the database be encrypted and that the database be protected against SQL injection attacks. Additionally, they need to monitor and audit all database activities for compliance. Which Azure features should the security architect recommend?

Accepted Answer

Enforce TLS 1.2 for connections, enable Azure Defender for SQL, and configure auditing to Azure Monitor logs.. The requirements are encrypted connections, SQL injection protection, and auditing. Enforcing TLS 1.2 ensures connections are encrypted. Azure Defender for SQL provides advanced threat protection that detects and alerts on SQL injection attempts. Configuring auditing to Azure Monitor logs centralizes monitoring and auditing. Together, these features meet the security and compliance needs for the Azure SQL Database.

Answer

Use Azure Private Link to connect to the database, enable Always Encrypted for sensitive columns, and use Azure Policy to enforce auditing.

Answer

Configure Azure SQL Database firewall rules to restrict IP addresses, enable Transparent Data Encryption (TDE), and use Azure Monitor for auditing.

Answer

Enable Azure SQL Database auditing to a storage account, configure Advanced Threat Protection, and enforce TLS 1.2 for connections.

Question 4

You are designing a security solution for an Azure environment that includes several storage accounts containing sensitive data. The company requires that all data in transit to the storage accounts be encrypted and that access be restricted to specific virtual networks. You need to recommend a solution that enforces these requirements and provides visibility into any non-compliant storage accounts. What should you recommend?

Accepted Answer

Enable secure transfer required on all storage accounts and configure network rules to allow access only from selected virtual networks and IP addresses. Use Azure Policy to deny creation of storage accounts that do not meet these settings.. The requirements are to enforce encryption in transit and restrict network access to specific virtual networks. Enabling secure transfer required ensures that all requests to the storage account use HTTPS, enforcing encryption in transit. Network rules can be configured to allow access only from selected virtual networks and IP addresses. Azure Policy with a deny effect ensures that new storage accounts cannot be created without these settings, providing preventive enforcement.

Answer

Deploy a network virtual appliance (NVA) to inspect all traffic to storage accounts and enforce encryption. Use Azure Policy to audit compliance.

Answer

Configure Azure Policy to audit storage accounts that do not require secure transfer and that allow access from all networks. Enable Defender for Storage to detect anomalies.

Answer

Use Azure Private Link to create private endpoints for all storage accounts and disable public access. Enable Microsoft Defender for Storage for threat detection.

Question 5

You are a security architect at Tailwind Traders. The company uses Microsoft 365 E5 and has a hybrid identity environment with Microsoft Entra Connect. The CIO wants to reduce the risk of credential theft and phishing attacks for all employees. You need to recommend an authentication method that eliminates passwords for users and aligns with Zero Trust principles. What should you recommend?

Accepted Answer

Microsoft Authenticator with phone sign-in. Microsoft Authenticator with phone sign-in provides a passwordless authentication method that works across devices and applications. It uses biometrics or PIN on the mobile device, reducing the risk of phishing and credential theft. This aligns with Zero Trust principles by verifying explicitly and eliminating passwords.

Answer

Certificate-based authentication

Answer

Windows Hello for Business

Answer

Security questions as a secondary authentication factor

Question 6

You are the security architect for a company that uses Azure Virtual Machines (VMs) running Windows Server and Linux. The company has a regulatory requirement that all VM disks must be encrypted at rest, including temporary disks and disk caches. You need to recommend a solution that meets the requirement and minimizes administrative overhead. What should you recommend?

Accepted Answer

Enable encryption at host for all VMs.. Encryption at host is the only option that encrypts all VM data, including temporary disks and disk caches, at the host level. It requires no guest OS configuration and simplifies key management compared to Azure Disk Encryption. The other options either do not cover temporary disks and caches or add unnecessary administrative complexity.

Answer

Enable Azure Disk Encryption (ADE) on each VM.

Answer

Use Azure Storage Service Encryption (SSE) for all VM disks.

Answer

Configure BitLocker on Windows VMs and DM-Crypt on Linux VMs.

Question 7

A financial services company uses Microsoft Sentinel as its SIEM. The security operations team wants to reduce the number of low-fidelity alerts that reach analysts by correlating related alerts into incidents and automatically closing incidents that match known benign patterns. The team also wants to preserve an audit trail of every automated closure. Which Microsoft Sentinel capability should you design into the solution?

Accepted Answer

Automation rules that run a playbook to close incidents matching a benign pattern. The requirement combines automated triage with an auditable record of the action. Automation rules are the Microsoft Sentinel feature that evaluates incident properties and can run a playbook or change status, and a playbook that closes the incident with a comment creates the audit trail. Analytics rules, workbooks, and connectors each address detection, visualization, or ingestion rather than automated incident closure.

Answer

Workbooks that visualize incident trends across the last 30 days

Answer

Data connectors that ingest Microsoft Defender XDR incidents into Microsoft Sentinel

Answer

Analytics rules configured with entity mapping to group alerts by IP address

Question 8

You are designing a Zero Trust strategy for Fabrikam Inc., which uses Microsoft Entra ID, Microsoft Intune, and Microsoft Defender for Endpoint. The security team wants to enforce the principle of least privilege for administrative access to Azure resources. They require that administrators use dedicated, cloud-only accounts with no permanent role assignments. You need to recommend a solution that provides just-in-time (JIT) privileged access with approval workflows and full auditing. What should you include in your design?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM). Microsoft Entra Privileged Identity Management (PIM) is the designated solution for just-in-time privileged access in Microsoft Entra ID and Azure. It enables eligible role assignments, requires approval and MFA for activation, and logs all activations for auditing. This aligns with Zero Trust principles of least privilege and verifies explicitly.

Answer

Microsoft Defender for Cloud just-in-time (JIT) VM access

Answer

Azure role-based access control (RBAC) with custom roles

Answer

Microsoft Entra ID Conditional Access with device compliance

Question 9

A retail company is designing a security operations model in Microsoft Sentinel. The security team wants to detect suspicious activity in Microsoft Entra ID, including sign-ins from unfamiliar locations and changes to privileged roles, and they want the detections to be based on Microsoft's continuously updated threat intelligence rather than custom queries. Which Microsoft Sentinel feature should you recommend?

Accepted Answer

Microsoft Sentinel solutions for Microsoft Entra ID that include analytics rule templates. The requirement is for Microsoft-maintained, continuously updated identity detections rather than custom logic. Solutions in the Microsoft Sentinel content hub deliver connectors, analytics rule templates, and other artifacts for domains such as Microsoft Entra ID, and the templates cover the described identity scenarios. Custom rules, threat intelligence connectors, and watchlists are supporting components, not the source of maintained detections.

Answer

A threat intelligence platform connector that ingests indicators of compromise

Answer

A watchlist that contains the company's list of privileged role assignments

Answer

Custom analytics rules written with Kusto Query Language against the SigninLogs table

Question 10

You are designing a security architecture for Litware Inc., which uses Microsoft 365 E5 and Azure. The company wants to adopt a Zero Trust model and needs to ensure that access to corporate resources is granted based on real-time risk assessment. The security team wants to automatically remediate risky user behavior by requiring password changes or blocking access. You need to recommend a solution that integrates with Microsoft Entra ID and provides risk-based conditional access. What should you recommend?

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection evaluates sign-in and user risk in real time and integrates with Conditional Access to enforce policies such as requiring MFA or password change for risky users. It can also block access when risk is high, providing the automated remediation and risk-based access required for a Zero Trust architecture.

Answer

Azure AD Conditional Access with named locations

Answer

Microsoft Cloud App Security (Defender for Cloud Apps) session policies

Answer

Microsoft Defender for Identity

Question 11

You are the security architect for a financial services company that stores customer PII in an Azure SQL Database. The database currently uses service-managed Transparent Data Encryption (TDE). A new regulatory requirement mandates that the company controls and rotates the encryption keys used to protect the database, and that all key operations are auditable. You need to recommend a solution that meets the requirement with the least administrative overhead. What should you recommend?

Accepted Answer

Configure TDE with a customer-managed key stored in Azure Key Vault (BYOK).. The requirement is customer control and auditability of the keys that protect data at rest in Azure SQL Database. Transparent Data Encryption with a customer-managed key in Azure Key Vault is the native Azure SQL feature that satisfies this: the customer owns the key, controls rotation and revocation, and Key Vault diagnostics provide the audit trail. Other options either protect a different data state or shift to an unsupported platform.

Answer

Enable Always Encrypted with secure enclaves on the sensitive columns.

Answer

Use service-managed TDE keys and enable Azure Policy to audit key rotation.

Answer

Store the database in an Azure Disk Encryption–protected VM-hosted SQL Server instance.

Question 12

A software company uses Microsoft 365 E5 and wants to ensure that when an employee is terminated, their access to all Microsoft Entra ID integrated applications is removed immediately and their manager is notified to reassign their files. The company wants to automate this without manual intervention from the IT help desk. Which Microsoft Entra ID Governance feature should you design into the solution?

Accepted Answer

Lifecycle workflows that run a leaver task on the employee's last day. The scenario calls for automated, event-driven removal of access plus manager notification at termination. Lifecycle workflows in Microsoft Entra ID Governance are built for exactly this leaver pattern, running tasks such as disabling the account, removing assignments, and sending notifications. Access reviews are periodic and manual, conditional access governs authentication conditions, and Privileged Identity Management governs privileged role activation.

Answer

Access reviews that require managers to certify their team's group memberships quarterly

Answer

Conditional Access policies that block sign-ins from unmanaged devices

Answer

Privileged Identity Management to make all application roles eligible rather than active

Question 13

You are designing a privileged access strategy for a company that uses Microsoft Entra ID. The company requires that administrators must activate their privileged roles only after providing a justification and obtaining approval from a designated approver. The activation must be limited to a maximum of 4 hours. You need to configure the solution. What should you use?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM) with role settings configured for approval and maximum activation duration.. Microsoft Entra Privileged Identity Management (PIM) is designed for just-in-time privileged access. It allows you to configure roles as eligible, requiring activation with justification and approval. You can set the maximum activation duration, such as 4 hours, and designate approvers. This ensures that administrators only have privileged access when needed and for a limited time, reducing the attack surface. Other options do not provide the required approval and time-bound activation features.

Answer

Microsoft Entra ID Protection risk policies that block sign-ins for privileged users with risky sign-in behavior.

Answer

Microsoft Entra ID Governance access reviews for privileged roles, configured to run monthly.

Answer

Conditional Access policies that require multi-factor authentication and compliant devices for privileged roles.

Question 14

A retail company uses Microsoft Purview to protect customer data across Microsoft 365 and Azure. The compliance team wants to detect when sensitive information such as credit card numbers is uploaded to SharePoint Online and automatically apply a sensitivity label that encrypts the content. The label must be applied without user interaction. You need to recommend the Purview capability to use. What should you recommend?

Accepted Answer

An auto-labeling policy for sensitive information types in Microsoft Purview.. The scenario requires automatic detection of sensitive information and automatic application of an encrypting sensitivity label, with no user involvement. Microsoft Purview auto-labeling policies are purpose-built for this: they use sensitive information types and trainable classifiers to find content in SharePoint Online and other locations and apply the designated label. DLP, mandatory labeling, and Insider Risk Management serve different purposes and do not apply encryption labels automatically.

Answer

An Insider Risk Management policy that flags credit card numbers in SharePoint.

Answer

A sensitivity label with user-defined permissions and mandatory labeling in SharePoint.

Answer

A data loss prevention policy that blocks uploads containing credit card numbers.

Question 15

A company uses Microsoft Intune to manage corporate devices. They want to ensure that only compliant devices can access corporate email in Outlook Mobile. Which type of policy should they configure?

Accepted Answer

Conditional Access policy. Conditional Access policy, because Conditional Access is the Intune/Microsoft Entra mechanism that enforces access decisions such as requiring a device to be compliant before granting access to corporate resources like Exchange Online for Outlook Mobile. In this scenario, the company needs an access control that evaluates device compliance at sign-in and blocks noncompliant devices, which is exactly what a Conditional Access policy with a 'Require device to be marked as compliant' grant control does. A compliance policy (D) only defines and evaluates compliance state but does not itself block or grant access, and a device configuration policy (B) merely configures settings on devices without enforcing access. An app protection policy (A) protects app data with PINs and encryption but does not gate access to corporate email based on device compliance.

Answer

App protection policy

Answer

Device configuration policy

Answer

Compliance policy