SC-100 Practice Test 45 — 15 Questions

Question 1

Refer to the exhibit. You are auditing an Azure subscription. The Azure Policy assignment above is targeting a resource group. The policy definition ID corresponds to a built-in policy that audits if SQL databases have transparent data encryption (TDE) enabled. What is the effect of this policy assignment?

Accepted Answer

The policy audits SQL databases for TDE and marks non-compliant resources.. Option B is correct. The policy assignment has enforcementMode set to 'Default', which means it will audit and enforce the policy (e.g., mark non-compliant resources). If enforcementMode were 'DoNotEnforce', it would only audit. Option A is wrong because enforcementMode is not set to DoNotEnforce. Option C is wrong because the policy does not automatically enable TDE; it only audits. Option D is wrong because the scope is a resource group, not an entire management group.

Answer

The policy automatically enables TDE on non-compliant SQL databases.

Answer

The policy is only reported as audit, not enforced.

Answer

The policy applies to all resources in the management group.

Question 2

Your organization is deploying Microsoft Defender for Cloud Apps. You need to create a policy that blocks downloads of sensitive files from sanctioned cloud apps to unmanaged devices. What type of policy should you create?

Accepted Answer

Session policy. Option B is correct because Session policies in Defender for Cloud Apps can monitor and control user sessions in real-time, including blocking downloads based on device tags. Option A is wrong because access policies control access but not session-level actions like downloads. Option C is wrong because app discovery policies are for discovering shadow IT. Option D is wrong because anomaly detection policies detect unusual behavior, not block downloads.

Answer

App discovery policy

Answer

Anomaly detection policy

Answer

Access policy

Question 3

A healthcare organization is designing a zero-trust application security strategy. They use Microsoft Entra ID for identity and plan to deploy a legacy on-premises web application with no modern authentication support. The solution must ensure that only authorized users can access the app and that access is logged for auditing. Which Microsoft security service should they use to secure access?

Accepted Answer

Microsoft Entra application proxy. Microsoft Entra application proxy provides secure remote access and conditional access for on-premises apps without requiring VPN or changes to the app. Option A is correct. Option B is wrong because Defender for Cloud Apps is for cloud apps. Option C is wrong because Azure AD B2C is for customer-facing apps. Option D is wrong because Microsoft Intune is for device management, not app access.

Answer

Azure AD B2C

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Intune

Question 4

A company uses Microsoft Defender XDR (formerly Microsoft 365 Defender) to protect their Microsoft 365 environment. They want to ensure that sensitive data is not leaked through Microsoft Teams messages. Which TWO capabilities should they use? (Choose TWO.)

Accepted Answer

Data Loss Prevention (DLP) policies. DLP policies in Microsoft Purview can scan Teams messages for sensitive data, and Communication Compliance policies can help detect policy violations. Option A and Option C are correct. Option B is wrong because sensitivity labels are for manual or automatic classification, not real-time scanning of messages. Option D is wrong because retention policies are for data retention, not prevention. Option E is wrong because Information Barriers prevent communication between groups, not data leakage.

Answer

Information Barriers

Answer

Sensitivity labels

Answer

Retention policies

Question 5

Your organization is designing a data protection strategy for Microsoft 365 using Microsoft Purview. You need to protect sensitive data from being shared externally via email. Which TWO capabilities should you include?

Accepted Answer

Sensitivity labels with encryption for emails and attachments. Options A and D are correct. Sensitivity labels with encryption prevent unauthorized sharing, and Data Loss Prevention (DLP) policies detect and block sharing of sensitive data. Option B is wrong because message encryption protects at rest/in transit but doesn't prevent sharing. Option C is wrong because retention labels manage data lifecycle, not sharing. Option E is wrong because Privileged Access Management controls administrative access, not end-user sharing.

Answer

Retention labels and policies

Answer

Microsoft Purview Message Encryption

Answer

Privileged Access Management (PAM)

Question 6

Your organization uses Azure API Management (APIM) to expose APIs to external partners. You need to ensure that only authorized partners can access the APIs and that the API requests are rate-limited to prevent abuse. What should you implement?

Accepted Answer

Use a validate JWT policy to authenticate partners and a rate-limit by key policy to control request rates.. Option D is correct because APIM policies can validate JWT tokens for authorization and use rate limiting policy to control request rates. Option A is wrong because subscription keys alone are not secure for partner authentication. Option B is wrong because OAuth 2.0 with API keys is not standard; APIM supports OAuth via policies. Option C is wrong because Client certificates are another method but not combined with rate limiting as effectively as policy.

Answer

Configure client certificate authentication and set a global rate limit in the APIM service.

Answer

Require a subscription key for each partner and configure IP whitelisting.

Answer

Use OAuth 2.0 tokens and store partner API keys in Azure Key Vault.

Question 7

A multinational corporation uses Microsoft Purview to classify and protect sensitive data. They need to ensure that any email containing a patient health record (PHI) is encrypted before delivery. Which capability should they use?

Accepted Answer

Microsoft Purview Message Encryption. Microsoft Purview Message Encryption allows sending encrypted email. Option B is correct. Option A is wrong because DLP policies trigger actions like blocking or encrypting, but the encryption itself is done by Message Encryption. Option C is wrong because sensitivity labels can apply encryption, but for automatic encryption of emails, DLP with encryption action is typical. Option D is wrong because Azure Information Protection is the underlying technology, but the policy is configured via Purview.

Answer

Data Loss Prevention (DLP) policy

Answer

Sensitivity label with encryption

Answer

Azure Information Protection

Question 8

Refer to the exhibit. A security administrator is reviewing a Conditional Access policy JSON. They want to ensure that users with medium risk level are prompted for multi-factor authentication (MFA), while high-risk users are blocked. The policy is not working as expected. Which issue is present in the policy?

Accepted Answer

The policy requires both user and sign-in risk to be high to block, but a user with high user risk and low sign-in risk would not be blocked. The policy uses 'and' logic for user and sign-in risk within the same rule, meaning both must be high to block, and both must be medium to require MFA. However, the conditions are combined with implicit 'and'. For the intended effect, separate policies or different condition structure is needed. Option C is correct. Option A is wrong because the syntax is valid JSON. Option B is wrong because there is no 'Or' condition issue; it's 'and'. Option D is wrong because the policy mode is 'default'.

Answer

The policy mode should be 'report-only'

Answer

The JSON syntax is invalid

Answer

The conditions are combined with 'Or' instead of 'And'

Question 9

Your company uses Microsoft Purview to manage data governance. You need to create a data classification rule that scans Azure Data Lake Storage for personally identifiable information (PII) such as email addresses. The rule must also apply a sensitivity label automatically. Which approach should you use?

Accepted Answer

Create a custom scan rule in Microsoft Purview and configure auto-labeling.. Option C is correct because Microsoft Purview has built-in scan rules for sensitive data types and can auto-label. Option A is wrong because Azure Policy is for compliance, not scanning. Option B is wrong because Microsoft Defender for Cloud is for security posture. Option D is wrong because custom Power Automate flows are not the primary method for classification.

Answer

Create an Azure Policy to detect and label PII.

Answer

Use a Power Automate flow to scan files and apply labels.

Answer

Use Microsoft Defender for Cloud to scan for PII.

Question 10

You are designing an API management solution using Azure API Management. Which TWO should you implement to protect the API from unauthorized access? (Choose TWO.)

Accepted Answer

Implement OAuth 2.0 authorization with Microsoft Entra ID.. A and D are correct. Subscription keys are a basic mechanism to authenticate callers. OAuth 2.0 is a standard authorization framework integrated with Azure API Management. Option B is wrong because client certificates are for mutual TLS, not a primary authentication method. Option C is wrong because IP filtering is for restricting IP ranges, not authentication. Option E is wrong because CORS is for cross-origin requests, not authentication.

Answer

Use client certificates for authentication.

Answer

Enable Cross-Origin Resource Sharing (CORS).

Answer

Restrict access by IP address only.

Question 11

You are analyzing sign-in logs in Microsoft Sentinel. The query returns users with ResultType 50074. What does this result type indicate?

Accepted Answer

The user did not pass strong authentication.. Option B is correct because ResultType 50074 indicates that strong authentication was required but the user did not pass it (e.g., MFA challenge failure or not performed). Option A is wrong because 50074 is not generic failure. Option C is wrong because 50074 is specific to strong authentication. Option D is wrong because it's not about conditional access policy, but authentication strength.

Answer

The user was blocked by a conditional access policy.

Answer

The user successfully signed in with MFA.

Answer

The user failed to sign in due to incorrect password.

Question 12

A company is developing a web API that will be consumed by partner applications. They need to secure the API using OAuth 2.0 and issue access tokens that expire after 1 hour. Which Microsoft Entra ID feature should they use?

Accepted Answer

App registration. Microsoft Entra ID (formerly Azure AD) provides OAuth 2.0 token issuance through app registrations. Option B is correct. Option A is wrong because Conditional Access is for access policies, not token issuance. Option C is wrong because Managed Identity is for Azure resources, not partner apps. Option D is wrong because Azure AD B2C is for customer identities.

Answer

Managed Identity

Answer

Conditional Access

Answer

Azure AD B2C

Question 13

Refer to the exhibit. A security architect is reviewing an ARM template that deploys an Azure Storage container. They want to ensure the container is not publicly accessible. What is the security implication of this template?

Accepted Answer

The template does not configure network rules, so the container may be accessible from the internet, but only to authenticated users. The template sets 'publicAccess' to 'None', which means no anonymous access. However, the container inherits default network rules from the storage account. If the storage account firewall is not configured, the container may still be accessible over the internet by authenticated users. Option C is correct. Option A is wrong because public access is set to None. Option B is wrong because network rules are not defined in this template. Option D is wrong because the template does not mention encryption.

Answer

The container allows public access

Answer

The template creates a container with versioning enabled

Answer

The template enables encryption at rest

Question 14

Refer to the exhibit. This is a risk alert from Microsoft Entra ID Identity Protection for user jdoe@contoso.com. You are designing an automated response using Microsoft Sentinel. Which condition should you use to trigger a high-severity incident?

Accepted Answer

If the user risk level is 'high'. Option D is correct because the alert has a user risk level of 'high', which indicates a compromised account. Option A is wrong because risk event types are 'unfamiliarFeatures' and 'atypicalTravel', not 'leakedCredentials'. Option B is wrong because the sign-in risk level is 'medium', not 'high'. Option C is wrong because the user risk level is 'high', not 'medium'.

Answer

If the sign-in risk level is 'high'

Answer

If the risk event types include 'leakedCredentials'

Answer

If the user risk level is 'medium'

Question 15

You run the PowerShell command to retrieve the vulnerability assessment baseline for rule VA2108 on an Azure SQL Database. The command returns a baseline with multiple rows. What is the purpose of this baseline?

Accepted Answer

It defines the expected scan result for rule VA2108, so future scans do not flag the same findings.. Option D is correct because vulnerability assessment baselines define acceptable scan results for specific rules, so that future scans do not report the same findings as vulnerabilities. Option A is wrong because baselines do not fix vulnerabilities. Option B is wrong because the baseline is for a specific database, not all databases. Option C is wrong because baselines are not about performance.

Answer

It configures the database to ignore performance issues related to rule VA2108.

Answer

It sets the baseline for all databases on the server for rule VA2108.

Answer

It automatically remediates the vulnerability identified by rule VA2108.

SC-100 Practice Test 45 — 15 Questions

Exhibit

SC-100 Practice Test 45 — 15 Questions

Exhibit