SC-100 Practice Test 50 — 15 Questions

Question 1

Your organization is using Microsoft Defender for Cloud to assess the security posture of your Azure resources. You need to ensure that all storage accounts have secure transfer required enabled. Which Defender for Cloud feature should you use?

Accepted Answer

Security policies and initiatives. Option A is correct: Security policies and initiatives allow you to define and enforce compliance requirements. Option B is wrong: Just-In-Time VM access is for network access. Option C is wrong: Adaptive network hardening is for NSGs. Option D is wrong: File integrity monitoring is for critical files.

Answer

File integrity monitoring

Answer

Adaptive network hardening

Answer

Just-In-Time VM access

Question 2

A company is designing a secure API for a customer-facing application that will handle sensitive personal data. They need to ensure that only authorized client applications can call the API and that the identity of the end-user is verified. Which of the following should they implement?

Accepted Answer

OAuth 2.0 with client credentials and OpenID Connect. Option D is correct because OAuth 2.0 with client credentials and OpenID Connect provides both client authentication and user authentication. Option A is wrong because API keys only authenticate the client, not the user. Option B is wrong because Basic Auth transmits credentials in plaintext. Option C is wrong because JWT tokens are a format, not an authentication protocol.

Answer

HTTP Basic Authentication

Answer

JWT bearer tokens

Answer

API keys

Question 3

You are designing a solution to protect a web application hosted on Azure App Service. The application uses Azure SQL Database and stores sensitive customer data. You need to ensure that the data is encrypted at rest and in transit, and that the application is protected from common web attacks. Which TWO of the following should you implement?

Accepted Answer

Enforce TLS for Azure SQL Database connections. Option A and D are correct. Option A: Azure WAF protects against common web attacks like SQL injection and XSS. Option D: Azure SQL Database always encrypts data at rest with TDE, and enforcing TLS ensures encryption in transit. Option B is wrong because DDoS Protection is for network-layer attacks, not application-layer. Option C is wrong because Network Security Groups (NSGs) are for network traffic filtering, not for encrypting data in transit.

Answer

Azure Private Link for App Service

Answer

Network Security Groups (NSGs) on the subnet

Answer

Azure DDoS Protection Standard

Question 4

Your organization wants to enable Microsoft Defender for Cloud Apps to monitor and control the use of Box and Dropbox. Which TWO steps must you perform?

Accepted Answer

Connect the app using an app connector. Option A is correct because you need to connect the app via an app connector to allow monitoring. Option C is correct because Conditional Access App Control enables session-level control. Option B is wrong because cloud discovery automatically detects apps, but for sanctioned apps you use app connectors. Option D is wrong because you deploy a reverse proxy, not a forward proxy. Option E is wrong because you need to add the app to the sanctioned list after connecting.

Answer

Add Box and Dropbox to the unsanctioned list

Answer

Deploy a forward proxy

Answer

Run a cloud discovery report

Question 5

Refer to the exhibit. You run the PowerShell script to protect high-confidentiality resources. After execution, you find that some resources with tag 'Confidentiality=High' are still unprotected. What is the most likely reason?

Accepted Answer

Some resources are in a different resource group than expected.. Option B is correct because the script uses Get-AzResource which returns resources from all resource groups, but the lock creation uses -ResourceGroupName parameter. If a resource is in a different resource group than the one resolved from the resource object, the lock might fail or apply incorrectly. Option A is wrong because the script does not check for existing locks correctly, but the main issue is the resource group mismatch. Option C is wrong because the script checks for locks before creating new ones. Option D is wrong because tag inheritance is not the issue.

Answer

The script does not check for existing locks properly.

Answer

Tags are not inherited from resource groups.

Answer

The script overwrites existing locks.

Question 6

You are designing a data classification strategy for a Microsoft 365 tenant. You need to automatically classify documents that contain personally identifiable information (PII) and apply a retention label. Which Microsoft Purview feature should you use?

Accepted Answer

Auto-labeling policies. Option C is correct: Auto-labeling policies in Purview can automatically classify and apply labels based on sensitive information types. Option A is wrong: Trainable classifiers require training and are for more complex classification, not automatic for PII. Option B is wrong: Manual labeling is not automatic. Option D is wrong: DLP policies are for enforcement, not automatic labeling.

Answer

Trainable classifiers

Answer

Manual labeling

Answer

Data Loss Prevention (DLP) policies

Question 7

A company is building a new SaaS application that will be used by external customers. The application uses Azure API Management (APIM) to expose APIs. The security requirements include: (1) Only authenticated and authorized customers can call the APIs, (2) The API keys must be rotated automatically every 90 days, (3) The APIs must be protected against common web vulnerabilities. What should you implement?

Accepted Answer

Use OAuth 2.0 with Azure AD (Entra ID) for authentication, configure API key rotation in APIM policies, and enable Azure Web Application Firewall (WAF) in front of APIM.. Option D is correct because it combines OAuth 2.0 for authentication and authorization, automatic key rotation via APIM policies, and Azure WAF for vulnerability protection. Option A is wrong because IP whitelisting is not a strong authentication method. Option B is wrong because client certificates require certificate management and do not protect against web vulnerabilities. Option C is wrong because rate limiting does not address authentication or vulnerability protection.

Answer

Use IP whitelisting in APIM to restrict access to known customer IPs and enable API key rotation manually every 90 days.

Answer

Require client certificates for authentication and configure APIM to automatically rotate the certificates.

Answer

Implement OAuth 2.0 with JWT tokens and use rate limiting to mitigate attacks.

Question 8

You are designing a secure data sharing solution for a research organization that needs to share large datasets with external universities. The data must be encrypted at rest and in transit, and access must be time-limited. The solution should minimize administrative overhead. What should you use?

Accepted Answer

Azure Storage with shared access signatures (SAS) and Azure Key Vault. Option D is correct because Azure Storage with SAS tokens provides time-limited access, encryption at rest (SSE), and encryption in transit (HTTPS). Option A is wrong because Azure File Sync focuses on syncing files, not secure sharing. Option B is wrong because Azure Data Share is more for periodic snapshots, not direct access. Option C is wrong because SFTP requires more administrative overhead for user management.

Answer

Azure Blob Storage with SFTP protocol enabled

Answer

Azure Data Share with snapshot-based sharing

Answer

Azure File Sync with on-premises file servers

Question 9

Refer to the exhibit. What is the purpose of this KQL query?

Accepted Answer

To retrieve SQL injection alerts from the past 7 days with specific fields.. Option B is correct. The query filters for SQL injection alerts in the last 7 days and projects relevant columns. Option A is wrong because it does not show all alerts, only SQL injection ones. Option C is wrong because it does not join with other tables. Option D is wrong because it does not aggregate or count alerts.

Answer

To count the number of SQL injection alerts by severity.

Answer

To join security alerts with other data sources to find compromised entities.

Answer

To list all security alerts generated in the last 7 days.

Question 10

You have created a custom Azure RBAC role named 'Custom SQL DB Reader' as shown in the exhibit. You assign this role to a user. The user reports they cannot read data from an Azure SQL Database. What is the most likely cause?

Accepted Answer

The Azure SQL Database is not configured to support Azure AD authentication. Option D is correct because the role includes dataActions for read, but Azure SQL Database uses SQL authentication or Azure AD authentication; RBAC dataActions are only effective if the user authenticates via Azure AD and the database is configured to support Azure AD authentication. Option A is wrong because the role includes Microsoft.Sql/servers/databases/read action. Option B is wrong because dataActions are present. Option C is wrong because assignableScopes includes the subscription.

Answer

The role does not include 'Microsoft.Sql/servers/databases/read' action

Answer

The assignableScopes does not include the resource group

Answer

The role does not include any dataActions

Question 11

Your company uses Microsoft Azure to host a critical application that processes credit card payments. The application must comply with PCI DSS. You need to ensure that all access to cardholder data is logged and monitored, and that any unauthorized access attempts trigger an alert. Which combination of services should you use?

Accepted Answer

Azure Monitor and Microsoft Sentinel. Option B is correct: Azure Monitor logs access, and Microsoft Sentinel provides alerting. Option A is wrong: Defender for Cloud provides security posture but not logging. Option C is wrong: Azure Policy enforces compliance but does not log or alert. Option D is wrong: Key Vault is for secrets, not logging.

Answer

Azure Policy and Microsoft Defender for Cloud Apps

Answer

Azure Policy and Microsoft Defender for Cloud

Answer

Azure Key Vault and Microsoft Defender for Cloud

Question 12

Your organization is deploying a customer-facing web application in Azure. The application must authenticate users via Microsoft Entra ID and access Microsoft Graph to read user profiles. The security team requires that the application never has access to user passwords. Which authentication flow should you recommend?

Accepted Answer

OAuth 2.0 authorization code flow with PKCE. Option B is correct because the OAuth 2.0 authorization code flow with PKCE is the recommended flow for native and web apps that need to access APIs without exposing user credentials. Option A is wrong because client credentials flow is for server-to-server scenarios without a user context. Option C is wrong because device authorization flow is for devices with limited input capabilities. Option D is wrong because implicit grant flow is deprecated due to security concerns.

Answer

OAuth 2.0 implicit grant flow

Answer

OAuth 2.0 device authorization flow

Answer

OAuth 2.0 client credentials grant flow

Question 13

Your company uses Microsoft Purview to classify and protect sensitive data. You need to ensure that when a user sends an email containing a credit card number, the email is automatically encrypted and a notification is sent to the user. Which Microsoft Purview feature should you configure?

Accepted Answer

Data Loss Prevention (DLP) policies. Option B is correct because Data Loss Prevention (DLP) policies in Microsoft Purview can automatically apply encryption and send notifications when sensitive data is detected in emails. Option A is wrong because sensitivity labels require user action or auto-labeling, but not automatic encryption on send. Option C is wrong because audit logs only record events, not enforce controls. Option D is wrong because insider risk management focuses on user behavior, not content protection.

Answer

Sensitivity labels

Answer

Audit log policies

Answer

Insider risk management policies

Question 14

Your organization uses Microsoft Sentinel as its SIEM. You need to collect logs from a custom line-of-business application that does not support standard syslog or Windows Event Log. The application writes logs to a text file on a Windows server. What is the most efficient way to ingest these logs into Microsoft Sentinel?

Accepted Answer

Install the Log Analytics Agent (deprecated, but still available) on the server and configure custom log collection.. The Log Analytics Agent can collect custom text logs by specifying the log file path and parsing rules. This is the most direct method. Syslog is for Linux. Azure Monitor Agent does not support custom text logs natively. Event Hubs would require additional configuration. Option A is correct.

Answer

Configure the application to send logs to a syslog server and use a syslog connector.

Answer

Set up a Azure Event Hubs and have the application write logs to Event Hubs.

Answer

Use the Azure Monitor Agent to collect the text file via a custom data source.

Question 15

You are designing a secure CI/CD pipeline for a web application deployed to Azure Kubernetes Service (AKS). The security team requires that container images are scanned for vulnerabilities before deployment. Which two services should you integrate?

Accepted Answer

Microsoft Defender for Containers and Azure Container Registry. Option C is correct because Microsoft Defender for Containers integrates with ACR to scan images. Option A is wrong because Azure Policy can enforce rules but does not scan images. Option B is wrong because Azure DevOps does not scan images natively. Option D is wrong because Azure Key Vault stores secrets.

Answer

Azure DevOps and Azure Key Vault

Answer

Azure Policy and Azure DevOps

Answer

Azure Key Vault and Azure Container Registry