SC-100 Practice Test 48 — 15 Questions

Question 1

Your company uses Microsoft Purview to classify and protect sensitive data. You need to automatically detect and protect credit card numbers in documents stored in SharePoint Online. Which solution should you implement?

Accepted Answer

Create a Data Loss Prevention (DLP) policy to detect credit card numbers and block sharing.. Option B is correct because Microsoft Purview Data Loss Prevention (DLP) policies can automatically detect sensitive info types like credit card numbers and apply protection actions. Option A is wrong because Sensitivity labels require manual application or can be auto-labeled but DLP is more direct for detection. Option C is wrong because Microsoft Defender for Cloud Apps focuses on cloud app security, not document classification. Option D is wrong because Azure Information Protection (now part of Purview) is for labeling, not automatic detection of specific data patterns.

Answer

Configure Azure Information Protection to automatically apply protection.

Answer

Apply a sensitivity label that encrypts documents with credit card numbers.

Answer

Use Microsoft Defender for Cloud Apps to scan documents for credit card numbers.

Question 2

Refer to the exhibit. You are deploying an Azure Storage container for storing compliance records. The ARM template snippet above configures the container. Which statement accurately describes the configuration?

Accepted Answer

Blobs cannot be modified or deleted for 365 days after creation.. Option D is correct. The snippet sets publicAccess to 'None', so no anonymous access is allowed. It enables immutable storage with versioning and sets an immutability period of 365 days, meaning blobs cannot be deleted or modified for 365 days after creation. Option A is wrong because public access is set to None. Option B is wrong because allowProtectedAppendWrites is false, so append blobs cannot be written. Option C is wrong because versioning is enabled.

Answer

The container allows protected append writes.

Answer

Blob versioning is disabled for the container.

Answer

The container allows anonymous read access.

Question 3

You are designing a solution to securely store and manage secrets for a cloud-native application deployed on Azure Kubernetes Service (AKS). The application needs to retrieve database connection strings and API keys at runtime without hardcoding them. The solution must minimize administrative overhead and integrate with Azure Active Directory (now Microsoft Entra ID) for access control. Which service should you use?

Accepted Answer

Azure Key Vault with managed identities. Option C is correct: Azure Key Vault with managed identities for AKS allows secure secret retrieval without storing credentials in code or configuration, integrates with Entra ID, and minimizes overhead. Option A is wrong: Kubernetes Secrets are not encrypted by default and require additional configuration. Option B is wrong: Azure App Configuration can store configuration but is not optimized for secrets. Option D is wrong: HashiCorp Vault adds complexity and is not a native Azure service.

Answer

Kubernetes Secrets

Answer

HashiCorp Vault on AKS

Answer

Azure App Configuration

Question 4

Your company is developing a mobile application that uses Microsoft Authenticator to sign in users. The app needs to call a web API that is protected by Microsoft Entra ID. You need to ensure that the app uses the OAuth 2.0 authorization code flow with PKCE. Which Microsoft authentication library should you recommend?

Accepted Answer

Microsoft Authentication Library (MSAL). Option D is correct: Microsoft Authentication Library (MSAL) supports the authorization code flow with PKCE for mobile apps. Option A is wrong: Active Directory Authentication Library (ADAL) is deprecated. Option B is wrong: Azure AD Graph API is not an authentication library. Option C is wrong: Microsoft Graph API is for accessing resources, not authentication.

Answer

Microsoft Graph API

Answer

Active Directory Authentication Library (ADAL)

Answer

Azure AD Graph API

Question 5

Your organization uses Microsoft Entra Verified ID to issue verifiable credentials to employees. You need to design a solution that allows employees to prove their employment status to third-party apps without exposing their full identity. What should you implement?

Accepted Answer

Verifiable credentials with a custom credential type. Option B is correct because a verifiable credential can contain only the attributes required (e.g., employment status) and is presented via a wallet. Option A is wrong because a custom role does not issue credentials. Option C is wrong because Conditional Access controls access but does not issue proofs. Option D is wrong because managed identities are for Azure resources, not user identity.

Answer

Microsoft Entra ID custom roles

Answer

Azure managed identities

Answer

Conditional Access policy with session controls

Question 6

A company is designing a solution to protect Azure Functions that process sensitive data. They need to ensure that only authenticated and authorized callers can invoke the function, and that secrets are not hard-coded. Which THREE actions should they take?

Accepted Answer

Use managed identity to access Azure Key Vault for secrets. Option A is correct because using managed identity eliminates secrets in code. Option C is correct because Azure AD authentication validates tokens from callers. Option D is correct because function-level authorization keys (like 'Function' or 'Admin') provide an additional layer. Option B is wrong because connection strings are not for authentication of callers. Option E is wrong because client certificates are not the primary method for caller authentication in Azure Functions; managed identity and Azure AD are preferred.

Answer

Store connection strings in application settings

Answer

Require client certificates

Question 7

Your organization uses Microsoft Purview to map and classify data across Azure, on-premises, and multi-cloud sources. You need to ensure that sensitive data assets are automatically discovered and classified. Which Microsoft Purview component should you configure?

Accepted Answer

Data Map scanning. Option A is correct because Microsoft Purview Data Map scans and classifies data across sources. Option B is wrong because Data Catalog is the inventory, not scanning. Option C is wrong because Data Sharing is for sharing data. Option D is wrong because Data Estate Insights provides monitoring, not scanning.

Answer

Data Sharing

Answer

Data Catalog

Answer

Data Estate Insights

Question 8

Your organization uses Microsoft Purview to protect sensitive data. You need to implement a solution that automatically detects and protects personally identifiable information (PII) in Microsoft 365. Which THREE should be part of your solution? (Choose THREE.)

Accepted Answer

Microsoft Purview Information Protection scanner. B, C, and E are correct. Microsoft Purview Data Loss Prevention (DLP) policies can detect PII and apply actions. Sensitivity labels can classify data and enforce protection. Microsoft Purview Information Protection (formerly Azure Information Protection) scanners can scan on-premises data. Option A is wrong because Microsoft Defender for Cloud is for cloud security posture, not data classification. Option D is wrong because Azure Policy is for resource configuration, not data scanning.

Answer

Azure Policy

Answer

Microsoft Defender for Cloud

Question 9

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to create an analytics rule that detects when a user account is created outside of business hours from an unusual IP address. Which type of rule should you use?

Accepted Answer

Scheduled query rule. Option C is correct: Scheduled query rules run at regular intervals to detect suspicious activity based on KQL queries. Option A is wrong: Fusion is for multistage attacks. Option B is wrong: ML Behavior Analytics uses machine learning, not custom queries. Option D is wrong: Anomaly rules are for detecting anomalies, not specific conditions.

Answer

Anomaly rule

Answer

ML Behavior Analytics rule

Answer

Fusion rule

Question 10

Refer to the exhibit. A security administrator needs to ensure that the storage account 'securestore' is compliant with the company policy that requires encryption at rest using customer-managed keys and network access restricted to a specific virtual network. Which of the following statements is correct?

Accepted Answer

The storage account is compliant because it uses customer-managed keys from Key Vault and network access is restricted to a specific virtual network.. Option A is correct. The output shows 'keySource' is 'Microsoft.Keyvault' indicating customer-managed keys. Network ACLs have 'defaultAction': 'Deny' and a virtual network rule allowing traffic from vnet1/subnet1. Option B is wrong because the encryption is customer-managed, not Microsoft-managed. Option C is wrong because there is a VNet rule, but the default action is Deny, which restricts access. Option D is wrong because the output shows encryption is enabled for both blob and file services.

Answer

The storage account is compliant only if encryption is enabled for blob and file services.

Answer

The storage account is non-compliant because it uses Microsoft-managed keys for encryption.

Answer

The storage account is non-compliant because network access is allowed from any virtual network.

Question 11

Your company develops a web application hosted on Azure App Service. The application uses Azure SQL Database and requires managed identities to access the database. You need to ensure that the application can authenticate to Azure SQL without storing credentials in code. Which authentication method should you implement?

Accepted Answer

Enable system-assigned managed identity on the App Service and grant it access to the SQL database.. Option B is correct because system-assigned managed identity is the simplest and most secure way for an Azure App Service to authenticate to Azure SQL without credential storage. Option A is wrong because Azure AD service principals require secret management. Option C is wrong because certificate-based authentication still requires certificate deployment. Option D is wrong because access keys are static credentials.

Answer

Store a client certificate in Azure Key Vault and reference it from the app.

Answer

Use an Azure AD service principal with a client secret.

Answer

Use Azure SQL database-level firewall rules with a static IP restriction.

Question 12

Your application uses Azure Key Vault to store secrets. You need to ensure that the application rotates secrets automatically without downtime. Which feature should you enable?

Accepted Answer

Key Vault automatic rotation with Event Grid integration. Option B is correct because Key Vault automatic rotation with Event Grid notifications allows the application to be notified before expiration and rotate seamlessly. Option A is wrong because manual rotation requires intervention. Option C is wrong because soft-delete only protects against accidental deletion. Option D is wrong because RBAC controls access, not rotation.

Answer

Key Vault manual rotation

Answer

Key Vault soft-delete

Answer

Key Vault RBAC

Question 13

You are designing a solution for a healthcare organization that needs to share patient health information (PHI) with a partner organization. The partner must be able to query the data but should not be able to modify it. Both organizations use Microsoft Entra ID. What should you use?

Accepted Answer

Microsoft Entra entitlement management with an access package that grants read-only access to a SharePoint Online site.. Option A is correct because Microsoft Entra entitlement management allows you to create access packages that grant external users read-only access to SharePoint Online or other resources. Option B is wrong because Azure AD B2C is for customer identity. Option C is wrong because Microsoft Purview Information Protection is for classification and labeling, not for external sharing with read-only access. Option D is wrong because Azure DevOps is for development collaboration.

Answer

Azure Active Directory B2C (now part of Entra) to allow the partner to authenticate and access data via a custom API.

Answer

Microsoft Purview Information Protection to label the data and allow the partner to decrypt it.

Answer

Azure DevOps for sharing the data in a repository with read-only permissions.

Question 14

Your organization is implementing Microsoft Defender for Cloud Apps to protect against malicious OAuth app permissions. Users have been granting permissions to third-party apps that request excessive scopes. What should you configure to automatically revoke such permissions?

Accepted Answer

OAuth app policies in Defender for Cloud Apps. Option B is correct: OAuth app policies in Defender for Cloud Apps allow you to set policies to automatically revoke permissions for apps that meet certain criteria. Option A is wrong: Conditional Access policies can block access but do not revoke app permissions. Option C is wrong: Azure AD app permissions management is part of Entra ID, but automatic revocation is done via Defender for Cloud Apps. Option D is wrong: Intune is for device management, not app permissions.

Answer

Microsoft Intune app protection policies

Answer

Conditional Access policies

Answer

Azure AD app permissions management

Question 15

You are designing a solution for a multi-national corporation that uses Microsoft Purview to govern data across Azure SQL Database, Azure Data Lake Storage, and Microsoft 365. The data classification labels must be automatically applied based on sensitive data types such as credit card numbers and passport numbers. Which Microsoft Purview capability should you use?

Accepted Answer

Microsoft Purview Data Map with automatic classification. Option B is correct because Microsoft Purview Data Map with automatic classification scanning can scan data sources and apply sensitivity labels based on built-in or custom data types. Option A is wrong because Information Protection is for labeling and protection in Microsoft 365, not for scanning data sources. Option C is wrong because DLP policies are for preventing data loss, not for automatic classification. Option D is wrong because Audit is for logging activities.

Answer

Microsoft Purview Data Loss Prevention (DLP) policies

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Information Protection