SC-100 Practice Test 46 — 15 Questions

Question 1

A security architect is designing a data protection strategy for a Microsoft 365 tenant. The company must prevent users from sharing sensitive documents with external users via SharePoint Online. They want to apply a policy that automatically detects sensitive content and blocks external sharing. Which Microsoft Purview solution should they use?

Accepted Answer

Data Loss Prevention (DLP) policy. Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive data and block external sharing. Option C is correct. Option A is wrong because sensitivity labels require manual application or automatic classification, but blocking external sharing is typically done by DLP. Option B is wrong because retention policies are for data retention, not blocking sharing. Option D is wrong because Microsoft Purview Information Protection is the umbrella, but the specific policy is DLP.

Answer

Sensitivity labels

Answer

Retention policies

Answer

Microsoft Purview Information Protection

Question 2

Your organization is designing a solution to protect sensitive data in Microsoft 365. You need to implement Microsoft Purview Data Loss Prevention (DLP) policies. Which TWO actions can a DLP policy take when a match occurs? (Choose TWO.)

Accepted Answer

Block the sharing of sensitive information.. Options A and D are correct. DLP policies can block sharing and show a policy tip to users. Option B is wrong because auto-labeling is a separate feature (auto-labeling policies). Option C is wrong because DLP policies do not quarantine items. Option E is wrong because encryption is applied via sensitivity labels, not DLP directly.

Answer

Encrypt the file with Azure Information Protection.

Answer

Quarantine the file for administrator review.

Answer

Automatically apply a sensitivity label.

Question 3

A company uses Microsoft Defender for Cloud to protect their hybrid environment. They have on-premises servers that are monitored by Microsoft Defender for Servers. The security team notices that some servers are missing critical security updates. They want to automatically remediate missing updates on these servers. Which feature should they enable?

Accepted Answer

Azure Update Manager. Defender for Cloud can integrate with Azure Update Manager (formerly Update Management) to remediate missing updates. Option D is correct. Option A is wrong because Azure Automation Update Management is the legacy solution, but the current recommendation is Azure Update Manager. Option B is wrong because Just-in-Time access is for VM access control. Option C is wrong because Adaptive Application Controls are for allowing specific applications.

Answer

Adaptive Application Controls

Answer

Azure Automation Update Management

Answer

Just-in-Time (JIT) VM access

Question 4

Refer to the exhibit. You are reviewing an ARM template for an Azure Function App. The function app uses a user-assigned managed identity and references a Key Vault secret for the storage connection string. The deployment fails because the function app cannot access the Key Vault secret. What is the most likely cause?

Accepted Answer

The user-assigned managed identity does not have a Key Vault access policy to get secrets. Option A is correct because the user-assigned managed identity must have a Key Vault access policy to read secrets. Option B is wrong because the secret name is 'storage-connection', not 'storage-connection-string'. Option C is wrong because the reference syntax is correct for Key Vault references. Option D is wrong because a custom DNS is not relevant.

Answer

The function app is configured with a custom DNS server that cannot resolve the Key Vault URI

Answer

The secret name in the URI does not match the actual secret name in Key Vault

Answer

The Key Vault reference syntax is incorrect; it should use '@Microsoft.KeyVault(SecretUri=...)'

Question 5

A company uses Microsoft Sentinel for security operations. They want to collect logs from a custom application running on Azure Virtual Machines. The application writes logs to a local file. Which data connector should they use?

Accepted Answer

Custom Logs via Log Analytics agent. The Log Analytics agent (or Azure Monitor Agent) can collect custom log files from VMs. Option C is correct. Option A is wrong because Syslog is for Linux, but the application writes to a file, not syslog. Option B is wrong because Windows Event Log is for Windows event logs, not custom file logs. Option D is wrong because Application Insights is for application performance monitoring, not log file collection.

Answer

Application Insights

Answer

Syslog

Answer

Windows Event Forwarding

Question 6

Your organization is designing a new application that will store sensitive customer data in Azure Cosmos DB. You need to ensure that data at rest is encrypted using a customer-managed key (CMK) stored in Azure Key Vault. What should you configure?

Accepted Answer

Configure a customer-managed key in Azure Key Vault and assign it to the Cosmos DB account.. Option A is correct because Azure Cosmos DB supports CMK by creating an encryption key in Azure Key Vault and associating it with the Cosmos DB account. Option B is wrong because Transparent Data Encryption (TDE) is for SQL databases, not Cosmos DB. Option C is wrong because Always Encrypted is for SQL Server. Option D is wrong because Azure Storage Service Encryption is for storage accounts, not Cosmos DB.

Answer

Enable Transparent Data Encryption (TDE) on the Cosmos DB account.

Answer

Enable Azure Storage Service Encryption (SSE) on the Cosmos DB account.

Answer

Use Always Encrypted with Azure SQL Database.

Question 7

A financial services company is deploying a new application on Azure Kubernetes Service (AKS). The application must meet PCI DSS compliance requirements, which mandate encryption of data at rest and in transit, as well as network segmentation. The application will use Azure SQL Database. What is the MOST secure approach to meet these requirements?

Accepted Answer

Use Azure Policy to enforce encryption and network policies in AKS, and enable TDE and Always Encrypted for Azure SQL Database.. Option C is correct because it combines Azure Policy to enforce encryption, network policies for segmentation, and Azure SQL Database with TDE and Always Encrypted for data protection. Option A is wrong because service endpoints do not encrypt in-transit traffic and do not provide segmentation. Option B is wrong because Azure Firewall is a perimeter firewall, not granular network policy within AKS. Option D is wrong because App Service Environment is not used for AKS.

Answer

Deploy the application in an Azure App Service Environment (ASE) with a private endpoint and enable SQL Server encryption.

Answer

Use Azure Service Endpoints for the AKS cluster and enable Transparent Data Encryption (TDE) on Azure SQL Database.

Answer

Deploy Azure Firewall in front of the AKS cluster and enable SSL/TLS termination at the firewall for all incoming traffic.

Question 8

An organization is using Microsoft Defender for Cloud to secure their Azure workloads. They have several Azure SQL databases that store sensitive financial data. The security team wants to receive alerts when a user attempts to access the database from a suspicious IP address or at an unusual time. Which Defender for Cloud plan provides this capability?

Accepted Answer

Defender for SQL. Defender for Cloud includes Defender for SQL, which provides anomalous activity detection for Azure SQL databases. Option B is correct. Option A is wrong because Defender for Databases is a broader plan that includes SQL detection, but the specific feature is anomalous activity. Option C is wrong because Defender for Cloud SQL is not a plan name. Option D is wrong because Microsoft Sentinel is for SIEM, not built-in database protection.

Answer

Defender for Databases

Answer

Defender for Cloud SQL

Answer

Microsoft Sentinel

Question 9

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel to find high-risk sign-ins. The query returns no results, but they know there were high-risk sign-ins. What is the most likely reason?

Accepted Answer

The value 'high' should be 'High' (capitalized). The query uses 'RiskLevelDuringSignIn' and 'RiskLevelAggregated' but filters on 'RiskLevelDuringSignIn'. However, in the schema, the field is named 'RiskLevelDuringSignIn' correctly. But the query uses 'where RiskLevelDuringSignIn == "high"' but the field may store values as 'High' (capitalized). Option C is correct. Option A is wrong because the field exists. Option B is wrong because the query is valid syntax. Option D is wrong because the time range is last 1 day.

Answer

The query uses double equals instead of single equals

Answer

The field name is incorrect; it should be 'RiskLevel'

Answer

The time range should be 'ago(7d)'

Question 10

Your company is developing a Microsoft Teams app that accesses user profiles. You need to ensure the app only accesses minimal required data. What should you implement?

Accepted Answer

Delegated permissions with User.Read. Option D is correct because Microsoft Graph delegated permissions with least privilege ensure the app only accesses the minimum required data. Option A is wrong because app-only permissions grant broad access. Option B is wrong because admin consent grants full access. Option C is wrong because application permissions are for background services, not user context.

Answer

Admin consent for all scopes

Answer

Application permissions for Microsoft Graph

Answer

Delegated permissions with User.Read.All

Question 11

Your company is developing a web application that stores sensitive customer data in Azure SQL Database. The data must be encrypted at rest and in transit. Additionally, you need to ensure that only the application can access the database, not individual administrators. Which two technologies should you implement? (Choose two.)

Accepted Answer

Azure Key Vault. Option A is correct: Transparent Data Encryption (TDE) encrypts data at rest. Option C is correct: Always Encrypted protects data in transit and during processing by keeping encryption keys client-side, preventing administrators from seeing plaintext. Option B is wrong: Azure Information Protection is for labeling and classification, not database encryption. Option D is wrong: Dynamic Data Masking obfuscates data but does not encrypt it. Option E is wrong: Azure Key Vault is used to store keys but is not the encryption mechanism itself.

Answer

Azure Information Protection

Answer

Dynamic Data Masking

Answer

Always Encrypted

Answer

Transparent Data Encryption (TDE)

Question 12

A company uses Microsoft Intune to manage corporate devices. They want to ensure that only compliant devices can access corporate email in Outlook Mobile. Which type of policy should they configure?

Accepted Answer

Conditional Access policy. Conditional Access in Microsoft Entra ID can require device compliance before granting access. Option B is correct. Option A is wrong because compliance policies define what compliance means, but the enforcement is via Conditional Access. Option C is wrong because app protection policies are for app-level controls, not device compliance. Option D is wrong because device configuration policies are for settings, not access control.

Answer

App protection policy

Answer

Device configuration policy

Answer

Compliance policy

Question 13

Your company is migrating a legacy on-premises web application to Azure App Service. The application uses Windows Integrated Authentication and connects to a SQL Server database. You need to design a security solution that minimizes changes to the application code while ensuring secure authentication and data protection. What should you use to authenticate users?

Accepted Answer

Microsoft Entra Application Proxy. Option C is correct because Microsoft Entra ID Application Proxy allows legacy apps to use Entra ID authentication without modifying code, by publishing the app through the proxy. Option A is wrong because Azure AD (now Entra ID) Domain Services provides domain join but requires code changes or a separate auth flow. Option B is wrong because App Service Authentication (EasyAuth) can be configured but may require code changes for WIA. Option D is wrong because a VPN doesn't solve authentication; it just secures network access.

Answer

Microsoft Entra Domain Services

Answer

App Service Authentication (EasyAuth) with Entra ID

Answer

Site-to-Site VPN with on-premises Active Directory

Question 14

A company deploys a multi-tier application on Azure Kubernetes Service (AKS). The application uses Azure Key Vault to store secrets. You need to ensure that pod-level access to secrets is restricted to only the pods that require them. What should you implement?

Accepted Answer

Use the AKS Secret Store CSI Driver with pod-managed identities. Option B is correct because AKS Secret Store CSI Driver allows mounting secrets from Key Vault into specific pods using pod identity, ensuring only authorized pods can access secrets. Option A is wrong because RBAC on the Key Vault itself is too coarse. Option C is wrong because Azure Policy for AKS can enforce compliance but doesn't manage secret access. Option D is wrong because managed identity is used for pod identity but needs the CSI driver to mount secrets.

Answer

Use a managed identity for each pod to access Key Vault directly

Answer

Configure Azure RBAC on the Key Vault to restrict access to the AKS cluster

Answer

Apply Azure Policy to deny access to Key Vault from unauthorized namespaces

Question 15

Your company develops an API that will be consumed by external partners. You need to secure the API using Azure API Management (APIM). Which authentication mechanism should you recommend for partner applications?

Accepted Answer

OAuth 2.0 with Microsoft Entra ID. Option C is correct because OAuth 2.0 is the standard for delegated access and is suitable for partner applications. Option A is wrong because subscription keys are for identification, not authentication. Option B is wrong because client certificates are for server-to-server, not typical for partner apps. Option D is wrong because IP whitelisting is network-level and not secure for authentication.

Answer

Client certificates

Answer

Subscription keys

Answer

IP address whitelisting