SC-100 Practice Test 47 — 15 Questions

Question 1

Your organization is designing a solution to protect sensitive data in Microsoft SharePoint Online. You need to ensure that documents containing credit card numbers are automatically encrypted when shared with external users. What should you configure?

Accepted Answer

An auto-labeling policy for sensitivity labels with encryption. Option B is correct because auto-labeling in Microsoft Purview can apply sensitivity labels that enforce encryption based on sensitive data patterns. Option A is wrong because DLP policies can block or warn but not automatically encrypt. Option C is wrong because retention labels manage lifecycle. Option D is wrong because IRM can protect but requires manual application or DLP integration, not automatic labeling.

Answer

A Data Loss Prevention (DLP) policy that blocks sharing

Answer

Information Rights Management (IRM) for SharePoint

Answer

A retention policy with a hold

Question 2

Your organization uses Microsoft Entra ID for identity and access management. You need to design a solution that allows external partners to access a specific SharePoint Online site without creating guest accounts. What should you use?

Accepted Answer

SharePoint Online external sharing with authenticated external users. Option B is correct because SharePoint Online external sharing can be configured to allow sharing with authenticated external users via Entra ID B2B collaboration, which creates guest accounts. Option A is wrong because Azure AD B2C is for customer-facing apps. Option C is wrong because Entra ID business-to-business (B2B) requires guest accounts. Option D is wrong because anonymous access is not secure for partners.

Answer

Anonymous sharing links

Answer

Microsoft Entra ID business-to-business (B2B) collaboration

Answer

Azure Active Directory B2C (now part of Entra ID)

Question 3

You are designing a solution to protect an Azure App Service web application from common web attacks like SQL injection and cross-site scripting. What should you implement?

Accepted Answer

Azure Web Application Firewall (WAF) policy on Azure Front Door. Option A is correct because Azure Web Application Firewall (WAF) with Application Gateway or Front Door protects against SQL injection and XSS. Option B is wrong because Network Security Groups (NSGs) filter network traffic, not application layer. Option C is wrong because Azure DDoS Protection protects against DDoS, not web attacks. Option D is wrong because Azure Firewall is a network firewall, not a web application firewall.

Answer

Azure Firewall

Answer

Azure DDoS Protection

Answer

Network Security Groups (NSGs) on the subnet

Question 4

Refer to the exhibit. You are reviewing an Azure Policy definition for storage accounts. You assign this policy with effect set to 'Deny' on a resource group. Which of the following scenarios will be blocked by this policy?

Accepted Answer

Creating a storage account with blob service encryption disabled. Option B is correct because the policy denies storage accounts that do not have blob service encryption enabled. Option A is wrong because the policy checks blob service encryption, not infrastructure encryption. Option C is wrong because the policy does not check TLS version. Option D is wrong because the policy does not check network access.

Answer

Creating a storage account with a firewall set to deny all public access

Answer

Creating a storage account with TLS 1.0 enabled

Answer

Creating a storage account with infrastructure encryption disabled

Question 5

Your organization uses Microsoft Entra ID for identity and access management. You are developing a web application that needs to access Microsoft Graph API on behalf of the signed-in user. Which authentication flow should you implement?

Accepted Answer

Authorization Code Flow with PKCE. Option B is correct because the Authorization Code Flow with PKCE is the recommended flow for web applications that need to access APIs on behalf of the user. Option A is wrong because Client Credentials Flow is for daemon applications, not on behalf of a user. Option C is wrong because Device Code Flow is for devices without browsers. Option D is wrong because Implicit Flow is legacy and less secure.

Answer

Implicit Flow

Answer

Client Credentials Flow

Answer

Device Code Flow

Question 6

You are designing a CI/CD pipeline for a containerized application using Azure DevOps. You need to ensure that container images are scanned for vulnerabilities before being deployed to production. Which service should you integrate?

Accepted Answer

Microsoft Defender for Cloud. Option B is correct because Microsoft Defender for Cloud (formerly Azure Security Center) can scan container images in Azure Container Registry for vulnerabilities. Option A is wrong because Azure Policy can enforce compliance but not scan images. Option C is wrong because Azure Key Vault is for secrets. Option D is wrong because Azure Monitor is for monitoring, not scanning.

Answer

Azure Policy

Answer

Azure Key Vault

Answer

Azure Monitor

Question 7

You need to design a secure solution for a web application that authenticates users via Microsoft Entra ID and calls a downstream API. Which TWO should you implement to secure the application? (Choose TWO.)

Accepted Answer

Use the OAuth 2.0 authorization code flow with PKCE.. B and C are correct. Using OAuth 2.0 authorization code flow (with PKCE) is the recommended authentication flow for web apps. Storing secrets in Azure Key Vault ensures they are securely managed. Option A is wrong because the client credentials flow is for server-to-server, not on behalf of users. Option D is wrong because storing secrets in configuration files is insecure. Option E is wrong because shared access signatures (SAS) are for storage, not API authentication.

Answer

Store application secrets in app configuration files.

Answer

Use the OAuth 2.0 client credentials flow.

Answer

Use shared access signatures (SAS) for API authentication.

Question 8

Your organization uses Microsoft Defender for Cloud to assess security posture. You need to ensure that your Azure App Service web applications are protected against common web vulnerabilities like SQL injection. What should you enable?

Accepted Answer

Web Application Firewall (WAF) on Azure Front Door. Option C is correct because Web Application Firewall (WAF) on Azure Front Door or Application Gateway protects against OWASP top 10 vulnerabilities including SQL injection. Option A is wrong because DDoS Protection protects against volumetric attacks, not web application attacks. Option B is wrong because JIT VM access reduces attack surface on VMs, not web apps. Option D is wrong because Adaptive Application Controls whitelist applications on servers, not protect against web attacks.

Answer

Just-in-time (JIT) VM access

Answer

Adaptive Application Controls

Answer

Azure DDoS Protection

Question 9

Your company uses Microsoft 365 and wants to prevent sensitive data from being copied to personal cloud storage services like Dropbox. Which TWO Microsoft Purview capabilities should you use?

Accepted Answer

Data Loss Prevention (DLP) policies in Microsoft Purview. Options B and D are correct. Endpoint DLP can block copying to personal cloud storage from devices, and DLP policies in Microsoft 365 can detect and block such actions. Option A is wrong because sensitivity labels classify but don't block actions. Option C is wrong because AIP is deprecated in favor of Purview. Option E is wrong because Cloud App Security can block downloads from cloud apps but not from endpoint to personal cloud.

Answer

Azure Information Protection (AIP) unified labeling client

Answer

Sensitivity labels

Answer

Microsoft Defender for Cloud Apps (formerly Cloud App Security)

Question 10

You are designing a microservices application running on Azure Kubernetes Service (AKS). You need to ensure that secrets (e.g., API keys, connection strings) are securely stored and automatically rotated without application downtime. What is the recommended approach?

Accepted Answer

Use Azure Key Vault with the Secrets Store CSI driver to mount secrets as volumes and enable rotation.. Option C is correct because using Azure Key Vault with the Secrets Store CSI driver allows pods to mount secrets as volumes, and rotation is handled by the driver. Option A is wrong because Kubernetes Secrets are base64-encoded, not encrypted by default. Option B is wrong because storing secrets in environment variables is less secure and harder to rotate. Option D is wrong because Azure App Configuration is for configuration, not secrets management.

Answer

Store secrets in Azure App Configuration with key vault references.

Answer

Store secrets as Kubernetes Secrets and use a controller to rotate them.

Answer

Inject secrets as environment variables from Azure Key Vault using a pod identity.

Question 11

You are designing a solution for an Azure SQL Database that stores sensitive financial data. The compliance team requires that all queries are audited and that access to sensitive columns is restricted for certain users. What should you implement?

Accepted Answer

Use Always Encrypted for sensitive columns and enable Azure SQL Auditing.. Option D is correct because using Always Encrypted protects sensitive columns at rest and in transit, and auditing via Azure SQL Auditing meets compliance. Option A is wrong because TDE encrypts the entire database, not columns. Option B is wrong because Dynamic Data Masking masks data but does not restrict access. Option C is wrong because Row-Level Security restricts rows, not columns.

Answer

Enable Transparent Data Encryption (TDE) and SQL Server Audit.

Answer

Use Dynamic Data Masking and SQL Server Audit.

Answer

Implement Row-Level Security (RLS) and enable audit.

Question 12

Your organization is developing a new application that will use Azure Cosmos DB. The security team requires that all data be encrypted at rest and in transit, and that access to the database is limited to specific Azure services and IP addresses. The application will run on Azure VMs. Which three actions should you take? (Choose three.)

Accepted Answer

Configure Cosmos DB to require TLS for all client connections.. Option A, B, and D are correct. Option A: Enforce TLS for all requests to Cosmos DB for encryption in transit. Option B: Use a private endpoint for Cosmos DB to restrict network access. Option D: Enable encryption at rest (which is on by default) and ensure customer-managed keys if required. Option C is wrong because firewall rules are needed, but they should be set to allow only the VM's public IP or the private endpoint; allowing all Azure services is too permissive. Option E is wrong because Azure SQL Database is not Cosmos DB.

Answer

Use Azure SQL Database instead of Cosmos DB for better security features.

Answer

Configure the Cosmos DB firewall to allow access from all Azure services.

Question 13

Refer to the exhibit. You are investigating a security incident in Microsoft Sentinel. The KQL query above is used to identify potential brute-force attacks. What does the query return?

Accepted Answer

A list of user accounts and computers where the account has more than 5 failed logins in the last 24 hours.. Option C is correct. The query filters SecurityEvent for user accounts (AccountType == 'User') in the last 24 hours, groups by Account and Computer, counts the number of events (FailedLogins), and then filters to only those accounts with more than 5 failed logins. Option A is wrong because it returns both Account and Computer. Option B is wrong because it does not return successful logins. Option D is wrong because it counts per account and computer, not just per computer.

Answer

A list of computers with more than 5 failed logins from any account.

Answer

A list of user accounts with more than 5 failed logins across all computers.

Answer

A list of user accounts with more than 5 successful logins in the last 24 hours.

Question 14

You are reviewing a Conditional Access policy in Microsoft Entra ID. The policy is intended to block sign-ins from high-risk users. However, some high-risk users are still able to sign in. What is the most likely reason?

Accepted Answer

The policy is not enforced because user risk is not being evaluated (e.g., missing licenses or risk policy). Option C is correct because the policy only blocks based on user risk level, but if the user risk is not evaluated or the policy is not in report-only mode, it may not enforce. However, the exhibit shows the policy is enabled, but if the user risk level is not being calculated in real-time (e.g., due to licensing), it may not trigger. Option A is wrong because locations include all. Option B is wrong because client app types include all. Option D is wrong because the policy is enabled.

Answer

The policy does not include all client app types

Answer

The policy is set to report-only mode

Answer

The policy does not include all locations

Question 15

Your organization is implementing a secure DevOps pipeline for Azure. You need to ensure that secrets (e.g., API keys) are not stored in source code and that access to production resources is controlled. Which THREE practices should you implement?

Accepted Answer

Use Azure Key Vault to store secrets and retrieve them at deployment time. Options A, B, and D are correct. Using Azure Key Vault for secrets, managed identities for Azure resources, and Azure DevOps variable groups linked to Key Vault are all secure practices. Option C is wrong because storing secrets in pipeline variables with encryption is not as secure as Key Vault. Option E is wrong because hardcoding secrets in configuration files is insecure.

Answer

Store secrets in Azure DevOps pipeline variables with encryption enabled

Answer

Store secrets in a configuration file in a private Git repository