SC-100 Practice Test 49 — 15 Questions

Question 1

Your organization uses Microsoft 365 and wants to prevent users from sharing sensitive documents externally via email. The solution must be able to detect credit card numbers and automatically block the email. Which technology should you use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online. Option A is correct because Microsoft Purview DLP policies can automatically detect sensitive information types like credit card numbers and block emails. Option B is wrong because Sensitivity labels are for classification, not for blocking. Option C is wrong because AIP (now part of Purview) is for labeling, not for blocking. Option D is wrong because Microsoft Defender for Office 365 focuses on phishing and malware, not on DLP.

Answer

Microsoft Purview Sensitivity labels with auto-classification

Answer

Microsoft Defender for Office 365 Safe Attachments

Answer

Azure Information Protection (AIP) unified labeling client

Question 2

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft 365. You need to ensure that when a user attempts to share a document containing credit card numbers externally, the action is blocked and the user is shown a policy tip. Which DLP rule configuration should you use?

Accepted Answer

Block the action with a policy tip and allow override. Option B is correct: Block with override and policy tip allows the block and shows the tip, while still allowing user override if they provide justification. Option A is wrong: Block without override is too restrictive and does not show a policy tip. Option C is wrong: Audit only does not block the action. Option D is wrong: Block with notification sends an email but not a policy tip.

Answer

Block the action and send an incident report in email

Answer

Audit the action only

Answer

Block the action without allowing override

Question 3

Your organization is developing a Power BI dashboard that uses data from an Azure SQL Database. The data includes personally identifiable information (PII). You need to mask the PII from certain users while allowing full access to data owners. What should you use?

Accepted Answer

Dynamic data masking in Azure SQL Database and row-level security in Power BI. Option A is correct because Power BI row-level security (RLS) can filter data based on user roles, but to mask specific columns, you need dynamic data masking in Azure SQL Database. Option B is wrong because sensitivity labels do not mask data. Option C is wrong because Azure SQL Database auditing logs access, does not mask. Option D is wrong because Microsoft Purview scans data, does not mask.

Answer

Azure SQL Database auditing and Microsoft Defender for Cloud

Answer

Microsoft Purview Data Map and data catalog

Answer

Microsoft Purview sensitivity labels and auto-labeling

Question 4

You are designing a data security solution for a Microsoft 365 tenant that contains highly confidential files. You need to ensure that these files are encrypted and can only be accessed by authorized users, even if the files are downloaded and stored on a personal device. Which technology should you use?

Accepted Answer

Microsoft Purview Information Protection with encryption and usage rights. Option D is correct: Microsoft Purview Information Protection with encryption and usage rights restricts access even after download, because the protection travels with the file. Option A is wrong: BitLocker encrypts the device, not individual files. Option B is wrong: Office 365 Message Encryption is for email, not files. Option C is wrong: Azure Information Protection (now part of Purview) is the correct technology, but the more specific answer is Purview Information Protection.

Answer

Office 365 Message Encryption

Answer

BitLocker Drive Encryption

Answer

Azure Information Protection

Question 5

Your organization uses Microsoft Defender for Cloud to secure multi-cloud workloads. You need to ensure that Azure, AWS, and GCP resources are assessed against a common set of security standards. Which capability should you use?

Accepted Answer

Regulatory compliance standards. Option A is correct because regulatory compliance standards in Defender for Cloud can be applied across Azure, AWS, and GCP to enforce common benchmarks. Option B is wrong because JIT is only for Azure VMs. Option C is wrong because vulnerability assessments are per-resource type. Option D is wrong because CNAPP is a broader framework, not a specific compliance standard.

Answer

Vulnerability assessment solutions

Answer

Cloud Security Posture Management (CSPM)

Answer

Just-in-time (JIT) VM access

Question 6

You are designing a secure data classification strategy for documents in Microsoft 365. The compliance officer wants to automatically apply a 'Confidential' label to documents containing credit card numbers. Which Microsoft Purview feature should you use?

Accepted Answer

Auto-labeling policies. Option C is correct because auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels based on sensitive info types. Option A is wrong because trainable classifiers require training and are for more complex patterns. Option B is wrong because manual labeling is not automatic. Option D is wrong because data loss prevention policies prevent sharing but do not apply labels.

Answer

Data loss prevention policies

Answer

Trainable classifiers

Answer

Manual labeling

Question 7

Which THREE security controls should you implement to protect a web application against common OWASP Top 10 vulnerabilities?

Accepted Answer

Input validation on all user inputs. Options A, C, and D are correct. WAF protects against many OWASP threats, input validation prevents injection, and CSP mitigates XSS. Option B is wrong because RBAC manages access, not application layer attacks. Option E is wrong because MFA is an identity control.

Answer

Role-Based Access Control (RBAC)

Answer

Multi-factor authentication (MFA)

Question 8

Your company runs a critical application on Azure VMs. You need to ensure that only authorized applications can run on the VMs to prevent malware. Which Azure security feature should you enable?

Accepted Answer

Windows Defender Application Control (WDAC). Option B is correct: Application Control (Windows Defender Application Control) allows you to specify which applications are allowed to run. Option A is wrong: Antimalware detects and removes malware but does not control which apps can run. Option C is wrong: Just-In-Time VM access controls network access, not application execution. Option D is wrong: Azure Security Center (now Defender for Cloud) provides recommendations but not direct app control.

Answer

Azure Security Center adaptive application controls

Answer

Just-In-Time VM access

Answer

Azure Antimalware

Question 9

A company is deploying a new application that uses Azure Cosmos DB. The security requirements include: data encryption at rest, data encryption in transit, and the ability to audit all data access. Which THREE of the following should you implement?

Accepted Answer

Require TLS for all connections to Cosmos DB. Option A, D, and E are correct. Option A: Cosmos DB requires TLS for all client connections by default, ensuring encryption in transit. Option D: Encryption at rest is enabled by default; using customer-managed keys provides additional control. Option E: Diagnostic logging enables auditing of data access. Option B is wrong because Azure SQL Database is a different service. Option C is wrong because Azure Active Directory (now Entra ID) authentication is supported but does not by itself encrypt data.

Answer

Use Azure SQL Database instead of Cosmos DB

Answer

Use Azure Active Directory authentication for Cosmos DB

Question 10

Your company uses Microsoft Defender for Cloud to secure Azure workloads. You need to ensure that all storage accounts have the 'Secure transfer required' setting enabled. What should you use?

Accepted Answer

Azure Policy. Option A is correct because Azure Policy can audit and enforce the 'Secure transfer required' setting across all storage accounts. Option B is wrong because Defender for Cloud recommendations are not enforced automatically. Option C is wrong because Azure Blueprints are deprecated. Option D is wrong because RBAC does not enforce resource configuration.

Answer

Azure role-based access control (RBAC)

Answer

Azure Blueprints

Answer

Microsoft Defender for Cloud regulatory compliance dashboard

Question 11

Your organization is deploying a new application on Azure Kubernetes Service (AKS). You need to secure container access to Azure resources using managed identities. Which THREE components are required? (Choose THREE.)

Accepted Answer

Pod identity (e.g., aad-pod-identity). Option A, Option B, and Option D are correct. A pod identity is needed to assign an identity to pods, Azure Key Vault stores secrets, and Azure AD pod-managed identity (or workload identity) provides the identity. Option C is incorrect because Azure Container Registry is for storing images, not identity. Option E is incorrect because Azure Firewall is for network security.

Answer

Azure Container Registry

Answer

Azure Firewall

Question 12

Your organization is using Microsoft Defender for Cloud to secure applications running on Azure. You need to ensure that all Azure Storage accounts have secure transfer required enabled. What is the BEST way to enforce this?

Accepted Answer

Assign an Azure Policy initiative that includes the built-in policy 'Secure transfer to storage accounts should be enabled' with a 'Deny' effect.. Option B is correct because Azure Policy can audit and enforce compliance at scale. Option A is wrong because while Defender for Cloud can detect the issue, it does not automatically enforce. Option C is wrong because Azure Blueprints is deprecated; Azure Policy is the correct tool. Option D is wrong because RBAC controls permissions, not configuration.

Answer

Create a custom recommendation in Microsoft Defender for Cloud to alert when storage accounts do not have secure transfer required.

Answer

Use Azure Blueprints to apply the setting to all subscriptions.

Answer

Grant the 'Storage Account Contributor' role to a security group that will manually enable the setting.

Question 13

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft 365. You need to create a DLP policy that detects and blocks sharing of credit card numbers in Exchange Online emails. Which TWO components must you configure?

Accepted Answer

Action to block sharing. Option A is correct because a sensitive info type for credit card number is required to identify the data. Option C is correct because the action 'Block' must be set to prevent sharing. Option B is wrong because a retention label is for data retention, not DLP. Option D is wrong because trainable classifiers are for complex patterns, but credit card numbers are predefined. Option E is wrong because auto-labeling is separate from DLP.

Answer

Retention label for financial data

Answer

Auto-labeling policy

Answer

Trainable classifier for credit card numbers

Question 14

A company is designing a secure data sharing solution with a partner organization. The data will be stored in Azure Blob Storage. Requirements include: encryption at rest with customer-managed keys, granular access control to specific blobs, and the ability to expire access automatically. Which TWO solutions should you combine? (Choose two.)

Accepted Answer

Generate shared access signatures (SAS) with specific permissions and expiry times.. Azure Storage Service Encryption with customer-managed keys (CMK) provides encryption at rest. Shared access signatures (SAS) provide granular, time-limited access to specific blobs. RBAC is less granular (container level). Azure AD authentication is not time-limited by default. Option A and C together meet all requirements.

Answer

Enable Azure Active Directory authentication for the storage account.

Answer

Configure a firewall on the storage account to allow only partner IP addresses.

Answer

Use Azure RBAC to assign the Storage Blob Data Reader role to partner users.

Question 15

A company uses Microsoft Sentinel to detect threats. They want to automatically send an email to the security team when a high-severity incident is created. What should they configure?

Accepted Answer

An analytics rule with an automated response. Option B is correct because analytics rules with automated responses can trigger a playbook to send email. Option A is wrong because workbooks are for visualization. Option C is wrong because watchlists are for reference data. Option D is wrong because hunting queries are for proactive threat hunting.

Answer

A workbook

Answer

A watchlist

Answer

A hunting query