SC-100 Practice Test 44 — 15 Questions

Question 1

A company uses Microsoft 365 and wants to protect sensitive documents from being shared externally. They need a solution that automatically classifies documents containing personally identifiable information (PII) and applies appropriate protection. Which two services should they combine?

Accepted Answer

Microsoft Purview Information Protection and Data Loss Prevention (DLP). Microsoft Purview Information Protection provides classification and labeling, while Data Loss Prevention (DLP) enforces protection actions. Option A is correct because these two services work together to automatically classify and protect documents. Option B is wrong because Microsoft Defender for Cloud Apps is for SaaS app security, not primarily for document classification. Option C is wrong because Azure Information Protection is the predecessor, now part of Purview. Option D is wrong because Microsoft Entra ID is for identity, not document classification.

Answer

Microsoft Defender for Cloud Apps and Microsoft Intune

Answer

Microsoft Purview Compliance Manager and Microsoft Sentinel

Answer

Azure Information Protection and Microsoft Entra ID

Question 2

Your organization uses Microsoft Defender for Cloud to protect Azure workloads. You need to ensure that all Azure SQL Databases have Threat Detection enabled and Advanced Threat Protection notifications are sent to the security team. What should you do?

Accepted Answer

Enable Advanced Threat Protection on the SQL Server and configure email notifications for all databases.. Option C is correct because the SQL Server's Defender for Cloud settings include an option to enable Advanced Threat Protection for all databases and configure email notifications. Option A is wrong because Azure Policy can enforce settings but doesn't configure notifications directly. Option B is wrong because Microsoft Sentinel setup is not required for this. Option D is wrong because enabling at the database level is less efficient and doesn't cover new databases.

Answer

Create an Azure Policy to audit Threat Detection settings and remediate non-compliant databases.

Answer

Enable Threat Detection on each individual Azure SQL Database and set the email recipients in the server's diagnostic settings.

Answer

Configure Microsoft Sentinel to monitor Azure SQL Databases and trigger alerts.

Question 3

Your company is deploying Microsoft Entra ID for application authentication. You need to register a new web application that uses OAuth 2.0 for user sign-in. Which authentication flow should you use?

Accepted Answer

Authorization code flow. Option B is correct because Authorization Code Flow is the recommended flow for web applications that have a backend server. Option A is wrong because Implicit Flow is deprecated for user sign-in. Option C is wrong because Client Credentials Flow is for server-to-server without user. Option D is wrong because Device Code Flow is for input-constrained devices.

Answer

Device code flow

Answer

Implicit flow

Answer

Client credentials flow

Question 4

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft Teams. You need to prevent users from sharing credit card numbers in Teams chat messages. However, the policy should allow sharing with external vendors if they are in your organization's approved list. What should you configure?

Accepted Answer

Configure a DLP policy with a condition to block sharing of credit card numbers to external users except those from approved domains.. Option D is correct because DLP policies for Teams can use conditions to restrict sharing to specific domains or approved external organizations. Option A is wrong because blocking all external sharing is too restrictive. Option B is wrong because sensitivity labels are separate from DLP and not designed for this granular condition. Option C is wrong because labels can't directly control sharing in Teams chat based on external party approval.

Answer

Create a DLP policy that blocks credit card numbers and set the action to 'Block external sharing' for all external users.

Answer

Use Microsoft Purview Information Protection to automatically apply a 'Confidential' label to messages containing credit card numbers and block forwarding.

Answer

Create a sensitivity label for credit card data and publish it to Teams, then configure auto-labeling.

Question 5

Your organization uses Microsoft Purview to govern data assets across Azure and on-premises. You need to automatically classify sensitive data such as credit card numbers in Azure SQL Database. What should you use?

Accepted Answer

Microsoft Purview Data Map. Option B is correct because Microsoft Purview Data Map can scan Azure SQL Database and apply automatic classification using built-in classifiers. Option A is wrong because Microsoft Sentinel is for SIEM, not data classification. Option C is wrong because Microsoft Defender for Cloud is for security posture, not data classification. Option D is wrong because Microsoft Entra ID is for identity.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Entra ID

Answer

Microsoft Sentinel

Question 6

You are reviewing the ARM template snippet for an Azure Storage container. What does the 'denyEncryptionScopeOverride' property set to 'true' ensure?

Accepted Answer

Users cannot override the default encryption scope for blobs in this container.. Option A is correct because when 'denyEncryptionScopeOverride' is true, all blobs in the container must use the default encryption scope and cannot specify a different scope. Option B is wrong because it is about enforcing default scope, not requiring customer-managed keys. Option C is wrong because encryption at rest is always enabled; this setting controls scope override. Option D is wrong because it doesn't affect double encryption.

Answer

Double encryption is enabled for the container.

Answer

Encryption at rest is required for all blobs in the container.

Answer

The container automatically uses a customer-managed key for encryption.

Question 7

Your organization uses Microsoft Sentinel to detect threats. You need to design a solution that automatically remediates a detected threat on an Azure VM by isolating the VM from the network. What should you use?

Accepted Answer

Create a Microsoft Sentinel automation rule that triggers a playbook to run an Azure Automation runbook to modify the NSG.. Option A is correct because Microsoft Sentinel can trigger a playbook (automation rule) that runs an Azure Automation runbook to modify the NSG and isolate the VM. Option B is wrong because Log Analytics workspace doesn't have remediation actions. Option C is wrong because Azure Policy is for compliance, not incident response. Option D is wrong because Defender for Cloud has some automation, but Sentinel playbook is the designed method for automated response.

Answer

Configure a Log Analytics workspace query to run on a schedule and automatically block the VM.

Answer

Use Azure Policy to audit and automatically remediate non-compliant VMs.

Answer

Enable Microsoft Defender for Cloud's 'Just-in-time VM access' policy.

Question 8

Your organization is using Microsoft Sentinel for security operations. Which THREE data sources can be connected to Microsoft Sentinel out of the box? (Choose THREE.)

Accepted Answer

Azure Active Directory (now Microsoft Entra ID). Options A, C, and D are valid out-of-the-box connectors. Option B is wrong because Azure DevOps is not a default data connector. Option E is wrong because Power BI is not a data source connector.

Answer

Azure DevOps

Answer

Power BI

Question 9

A company is designing a data classification strategy using Microsoft Purview. They need to automatically classify and protect sensitive data stored in Azure Blob Storage. Which TWO capabilities should they use? (Choose TWO.)

Accepted Answer

Sensitivity labels. Microsoft Purview Data Map provides auto-discovery and classification of data assets, and Sensitivity labels can apply protection. Option A and Option C are correct. Option B is wrong because DLP policies are for endpoint and Microsoft 365, not for Azure Blob. Option D is wrong because Information Barriers are for restricting communication, not classification. Option E is wrong because Azure Policy is for governance, not data classification.

Answer

Data Loss Prevention (DLP) policies

Answer

Information Barriers

Answer

Azure Policy

Question 10

Your company is designing a zero-trust security posture for a new application in Azure. The application uses Azure Functions, Azure SQL Database, and Azure Blob Storage. You need to ensure that data in transit is encrypted and that the application can authenticate without storing secrets in code. Which THREE actions should you take?

Accepted Answer

Enable 'Enforce minimum TLS version' on the Blob Storage account. Options A, C, and E are correct. Enforcing TLS 1.2 encrypts data in transit, managed identity for Azure Functions provides secretless authentication to Azure SQL, and Enforce minimum TLS version on Blob Storage ensures encrypted connections. Option B is wrong because firewall rules don't encrypt data. Option D is wrong because CMK is for encryption at rest, not in transit.

Answer

Enable customer-managed keys (CMK) for Azure SQL Database

Answer

Configure the Azure SQL firewall to allow only the Functions IP range

Question 11

Your organization is adopting Microsoft Copilot for Microsoft 365. You need to ensure that Copilot respects the existing sensitivity labels when processing data. What should you configure?

Accepted Answer

Configure sensitivity labels in Microsoft Purview Information Protection.. Option A is correct because Microsoft Purview Information Protection sensitivity labels are respected by Microsoft Copilot. Option B is wrong because DLP policies are for data loss prevention, not labeling. Option C is wrong because Retention labels are for retention, not sensitivity. Option D is wrong because sensitivity labels are the correct solution.

Answer

Create Data Loss Prevention (DLP) policies.

Answer

Use Azure Information Protection.

Answer

Apply retention labels to documents.

Question 12

Your company uses Microsoft Intune for mobile device management. You need to ensure that corporate data on iOS devices is protected by requiring a PIN and encrypting the device. What configuration should you create?

Accepted Answer

Create a compliance policy that requires a device PIN and encryption.. Option C is correct because a compliance policy in Intune defines device requirements like PIN and encryption. Option A is wrong because app protection policies target apps, not device-level settings. Option B is wrong because device configuration profiles can enforce settings but compliance policy is the standard way to require PIN and encryption for compliance. Option D is wrong because Conditional Access policies control access based on compliance, not enforce settings directly.

Answer

Create a device configuration profile to enforce PIN and encryption.

Answer

Create a Conditional Access policy that requires compliant devices.

Answer

Create an app protection policy for Microsoft apps.

Question 13

A company uses Microsoft Defender for Cloud Apps to enforce session policies. The security team needs to block downloads of sensitive files from Microsoft 365 when accessed from unmanaged devices. Which type of policy should they configure?

Accepted Answer

Session policy. Session policies in Defender for Cloud Apps allow real-time monitoring and control of user activities based on device state. Option A is correct. Option B is wrong because file policies are post-hoc, not real-time. Option C is wrong because access policies govern access at the app level, not session-level controls. Option D is wrong because DLP policies in Microsoft 365 are broader and not tied to session enforcement.

Answer

File policy

Answer

Data Loss Prevention (DLP) policy in Microsoft 365

Answer

Access policy

Question 14

A financial services company uses Microsoft Sentinel for SIEM. They need to detect potential data exfiltration from their Azure SQL Database. Which THREE data sources should they connect to Sentinel to achieve this? (Choose THREE.)

Accepted Answer

Azure Network Watcher NSG flow logs. Azure SQL Database audit logs contain query details; Azure Activity Logs provide resource management events; Network security group flow logs show network traffic patterns. Option A, Option B, and Option C are correct. Option D is wrong because Azure AD sign-in logs are for user authentication, not database operations. Option E is wrong because Microsoft Defender for Cloud alerts may cover threats but not raw data exfiltration details.

Answer

Microsoft Defender for Cloud alerts

Answer

Azure AD sign-in logs

Question 15

Your organization uses Microsoft Sentinel to detect threats. You need to ensure that sensitive data stored in Azure SQL Database is protected from unauthorized access by Sentinel playbooks. What should you implement?

Accepted Answer

Use a managed identity assigned to the playbook to authenticate to Azure SQL. Option A is correct because managed identities provide a secure, identity-based authentication for playbooks to access Azure SQL without storing credentials. Option B is wrong because firewall rules are network-level, not identity-based. Option C is wrong because data masking is for query results, not access control. Option D is wrong because CMK is for encryption at rest, not access control.

Answer

Enable dynamic data masking on the SQL database

Answer

Use customer-managed keys (CMK) for SQL Transparent Data Encryption

Answer

Configure Azure SQL firewall rules to allow only Sentinel IP addresses