SC-100 Practice Questions 2 — 50 Questions

Question 1

Your organization uses Microsoft Sentinel with the Microsoft 365 Defender connector. You need to create an analytics rule that generates an incident when a user is reported as compromised by Microsoft Defender for Identity. The rule should use the most efficient method to get this data. What should you use as the data source?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SecurityAlert table with a filter for Defender for Identity.. The SecurityAlert table contains security alerts from various sources, including Microsoft Defender for Identity, when ingested via the Microsoft 365 Defender connector. By filtering for Defender for Identity alerts, you can create an analytics rule that triggers an incident when a user is reported as compromised. This is the most efficient method because the alerts are already available in this table. Option B (DeviceEvents) is from Advanced Hunting and is not directly available in Sentinel tables; it requires running queries against the Microsoft 365 Defender advanced hunting schema, which is less efficient for creating analytics rules. Option C (OfficeActivity) contains Office 365 audit logs, not security alerts. Option D (IdentityInfo) contains identity information such as user details, but not alerts or compromise status.

Answer

The DeviceEvents table from Advanced Hunting.

Answer

The OfficeActivity table.

Answer

The IdentityInfo table.

Question 2

Your organization uses Microsoft Intune for mobile device management and Microsoft Entra ID for identity. You are designing a solution to ensure that only devices that are compliant with security policies can access corporate resources. The requirements are: 1) Devices must have a minimum OS version. 2) Devices must have encryption enabled. 3) Devices must not be jailbroken or rooted. 4) Access to corporate apps must be blocked if the device is non-compliant. 5) The solution should automatically remediate non-compliant devices when possible. You need to recommend the minimum configuration. What should you do?

Accepted Answer

Create a device compliance policy in Intune with the required settings, and create a Conditional Access policy that requires compliant devices.. The minimum configuration is to create a device compliance policy in Intune with the required settings (minimum OS version, encryption, jailbreak/root detection) and create a Conditional Access policy that requires compliant devices. This ensures only compliant devices can access corporate resources, and Intune can automatically remediate non-compliant devices where possible.

Answer

Configure Microsoft Purview Compliance Manager to assess compliance and block access.

Answer

Create an app protection policy in Intune that requires minimum OS and encryption.

Answer

Create a device configuration policy in Intune for the settings, and use Azure AD Identity Protection to block access.

Question 3

Your organization is deploying a new line-of-business application on Azure App Service. The app must authenticate users from Microsoft Entra ID and also access a downstream API that requires a client secret. You need to recommend the most secure method for managing the client secret. What should you use?

Accepted Answer

Store the secret in Azure Key Vault and use a Key Vault reference in App Service.. Storing the client secret in Azure Key Vault and referencing it from App Service via a Key Vault reference is the most secure method. Key Vault provides centralized secret management, access control via Entra ID, auditing, rotation capabilities, and hardware-backed protection (HSM) for keys. App Service can resolve Key Vault references at runtime using its managed identity, so the secret never appears in application settings or code.

Answer

Store the secret in the Azure AD app registration manifest.

Answer

Store the secret in an App Service application setting.

Answer

Store the secret in the application code as a constant.

Question 4

A multinational corporation uses Microsoft Entra ID for identity and Microsoft Defender for Cloud Apps for SaaS app governance. The security team wants to deploy a conditional access policy that blocks access from untrusted locations for all cloud apps except Microsoft 365, which should only be blocked if the device is not compliant. How should you configure the policy?

Accepted Answer

Create two conditional access policies: one for all cloud apps except Microsoft 365 blocking untrusted locations, and one for Microsoft 365 requiring compliant device.. Option B is correct because Conditional Access policies apply to either all cloud apps or specific apps, and Microsoft 365 cannot be excluded from one policy while having different conditions applied within the same policy. The scenario requires two separate policies: one targeting all cloud apps with Microsoft 365 excluded that blocks untrusted locations, and a second targeting Microsoft 365 that requires a compliant device. Option A is wrong because Defender for Cloud Apps session policies monitor or control sessions but do not block sign-ins from untrusted locations. Option C is wrong because a single policy cannot apply a compliant-device requirement only to Microsoft 365 while including all other cloud apps with different conditions. Option D is wrong because it blocks Microsoft 365 from untrusted locations unconditionally, ignoring the compliant-device exception.

Answer

Use a session policy in Defender for Cloud Apps to monitor non-compliant devices.

Answer

Create one conditional access policy that includes all cloud apps and requires compliant device for Microsoft 365 only.

Answer

Configure a conditional access policy that blocks access from untrusted locations for all apps.

Question 5

Your organization is implementing a privileged access strategy using Microsoft Entra Privileged Identity Management (PIM). The compliance team requires that all privileged role activations be approved by a manager and that an audit trail is maintained for at least one year. Which configuration should you recommend?

Accepted Answer

Set PIM role settings to require approval and enable audit logging. It directly addresses both compliance requirements: requiring approval ensures a manager authorizes each activation, and enabling audit logging in PIM retains activation history for at least one year. PIM role settings allow you to configure approval workflows and automatically log all activations to the Microsoft Entra audit log, which can be exported and retained for compliance purposes.

Answer

Configure access reviews for privileged roles

Answer

Enable Conditional Access policies for privileged roles

Answer

Require Azure MFA for role activation

Question 6

Wide World Importers is deploying a critical line-of-business application on Azure Kubernetes Service (AKS). The application processes financial transactions and must meet SOX compliance. You need to design a security solution that includes: encryption of secrets (e.g., database connection strings) using Azure Key Vault, automatic certificate rotation for TLS termination, network isolation of the AKS cluster, and audit logging of all access to secrets. The solution should use a managed identity for the AKS cluster to access Key Vault. Which of the following designs meets the requirements?

Accepted Answer

Enable managed identity for the AKS cluster, integrate Key Vault with AKS using the Secrets Store CSI driver, deploy the cluster as a private cluster, and enable diagnostic settings on Key Vault to send logs to a Log Analytics workspace.. Option A meets all requirements: using managed identity for AKS to access Key Vault (secure, no credentials), integrating Key Vault with AKS via the Secrets Store CSI driver (enables encryption and automatic certificate rotation), deploying as a private cluster (network isolation), and enabling diagnostic settings on Key Vault to send logs to Log Analytics (audit logging). This design leverages Azure-native integrations for security and compliance.

Answer

Use a service principal for AKS to access Key Vault, store secrets as Kubernetes secrets, configure a private cluster, and enable audit logging on Key Vault.

Answer

Enable managed identity for the AKS cluster, store secrets in the cluster's native Kubernetes secrets, use a private endpoint for the AKS API server, and enable Azure Monitor for containers.

Answer

Use a service principal to access Key Vault, store secrets as encrypted Kubernetes secrets with a customer-managed key, deploy a public cluster with network policies, and enable Key Vault logging.

Question 7

Your company uses Microsoft Entra ID for identity management. You need to implement a solution that allows external partners to access a specific application using their own identity providers, while ensuring that their accounts are automatically deprovisioned when removed from their home organization. Which feature should you use?

Accepted Answer

Entitlement management with connected organizations. Entitlement management with connected organizations in Microsoft Entra ID (part of Identity Governance) is designed exactly for this scenario: it lets you onboard external partners, define access packages tied to their home identity providers, and automatically deprovision access when the user leaves their home organization via lifecycle workflows and connected-organization sync. This provides both the cross-tenant access and the automatic deprovisioning requirement.

Answer

B2B direct federation

Answer

Self-service sign-up

Answer

Identity Governance access reviews

Question 8

A healthcare organization uses Microsoft Purview Information Protection to classify and protect patient data. They want to automatically apply a 'High Confidentiality' label to any document containing a patient ID pattern (###-####). The label should also encrypt the document. Which configuration should they use?

Accepted Answer

Sensitivity label with auto-labeling for sensitive info types. To automatically apply a label that encrypts documents containing a patient ID pattern, the organization should use a sensitivity label with auto-labeling configured for sensitive info types. Sensitivity labels can enforce encryption and are applied automatically based on conditions such as the presence of sensitive information types (e.g., a custom regex for ###-####).

Answer

Retention label with auto-labeling policy

Answer

Data Loss Prevention (DLP) policy with a block action

Answer

Trainable classifier with a retention policy

Question 9

A company uses Microsoft 365 and wants to protect sensitive documents from being shared externally. They need a solution that automatically classifies documents containing personally identifiable information (PII) and applies appropriate protection. Which two services should they combine?

Accepted Answer

Microsoft Purview Information Protection and Data Loss Prevention (DLP). Microsoft Purview Information Protection allows for classification and labeling of documents based on content, while Data Loss Prevention (DLP) policies can enforce actions such as blocking external sharing or applying encryption. Together, they provide automated protection for sensitive documents like those containing PII. Option D is correct because these two services work together to classify and protect documents. Option A is incorrect because Microsoft Defender for Cloud Apps focuses on SaaS app security and Intune is for device management; they do not directly classify documents. Option B is incorrect because Compliance Manager is for managing compliance posture, and Sentinel is a SIEM; they are not used for automatic document classification. Option C is incorrect because Azure Information Protection is a previous version, now part of Purview, and Microsoft Entra ID is an identity service; they do not provide the same integrated classification and DLP capabilities as the Purview solutions.

Answer

Microsoft Defender for Cloud Apps and Microsoft Intune

Answer

Microsoft Purview Compliance Manager and Microsoft Sentinel

Answer

Azure Information Protection and Microsoft Entra ID

Question 10

Your organization uses Microsoft Intune for mobile device management. You need to ensure that only compliant devices can access corporate email. What should you configure?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID that requires compliant device.. Conditional Access in Microsoft Entra ID can enforce device compliance for access. Option A is incorrect because app protection policies protect data within apps but do not control device-level access. Option B is incorrect because device configuration policies define settings but do not enforce compliance-based access. Option D is incorrect because device compliance policies define compliance requirements, but Conditional Access is needed to enforce them.

Answer

Configure an app protection policy in Intune.

Answer

Create a device configuration policy in Intune.

Answer

Create a device compliance policy in Intune.

Question 11

A small business uses Microsoft 365 Business Premium and wants to secure their Windows 10 devices with Microsoft Intune. They need to ensure that only devices compliant with the company's security policies can access corporate email. What should they configure?

Accepted Answer

Conditional Access policy requiring compliant device. Conditional Access in Microsoft Entra ID can require device compliance before granting access to Exchange Online. Device compliance policies in Intune define the security requirements. Microsoft Entra application proxy is for on-prem apps. Microsoft Defender for Cloud Apps is for cloud app security. Windows Defender Firewall is for network security.

Answer

Azure AD Application Proxy

Answer

Windows Defender Firewall rules

Answer

Microsoft Defender for Cloud Apps session policy

Question 12

Your organization is planning to use Microsoft Sentinel for security information and event management (SIEM). You need to ingest security logs from on-premises Active Directory. What should you deploy?

Accepted Answer

Azure Monitor Agent. The correct option is D, Azure Monitor Agent (AMA). AMA is the current, supported agent for collecting data into Log Analytics workspaces, which back Microsoft Sentinel, and it supports Data Collection Rules (DCRs) to ingest Windows security events from on-premises Active Directory domain controllers via the Azure Arc-enabled servers or the AMA extension. The Microsoft Monitoring Agent (A) and the Log Analytics agent (B) are legacy agents that are deprecated for Sentinel data collection and are being replaced by AMA. The Microsoft Defender for Cloud agent (C) is not a standalone log-ingestion agent for Sentinel; Defender for Cloud uses the Log Analytics/AMA agents for data collection, so it does not fit the requirement directly.

Answer

Microsoft Monitoring Agent (MMA)

Answer

Log Analytics agent

Answer

Microsoft Defender for Cloud agent

Question 13

Your team develops a web application hosted on Azure App Service. You need to secure the application against common web vulnerabilities like SQL injection and cross-site scripting. What should you implement?

Accepted Answer

Enable Azure Web Application Firewall (WAF) on Azure Front Door or Application Gateway.. The correct option is A: enabling Azure Web Application Firewall (WAF) on Azure Front Door or Application Gateway, because WAF provides managed rule sets (OWASP Core Rule Set) that inspect HTTP/HTTPS traffic and block layer 7 attacks such as SQL injection and cross-site scripting before they reach the App Service. Options B, C, and D do not address application-layer attacks: Key Vault with managed identity only protects secrets and credentials, NSGs filter traffic by IP/port/protocol at layers 3-4 and cannot detect SQLi or XSS payloads, and Azure DDoS Protection mitigates volumetric network-layer floods rather than web application vulnerabilities.

Answer

Store application secrets in Azure Key Vault and enable managed identity.

Answer

Configure Network Security Groups (NSGs) on the App Service subnet to restrict inbound traffic.

Answer

Enable Azure DDoS Protection on the virtual network.

Question 14

You are designing a solution to protect an Azure App Service web application from common web attacks like SQL injection and cross-site scripting. What should you implement?

Accepted Answer

Azure Web Application Firewall (WAF) policy on Azure Front Door. Azure Web Application Firewall (WAF) policy on Azure Front Door (option C) is correct because WAF is specifically designed to inspect HTTP/HTTPS traffic and block Layer 7 attacks such as SQL injection and cross-site scripting using managed rule sets (OWASP rules). Azure Front Door provides global edge delivery and integrates WAF policies directly, making it the appropriate choice for protecting a public web application. Azure Firewall (A) is a Layer 3-4 network firewall with limited FQDN filtering and does not provide OWASP-style web attack protection. Azure DDoS Protection (B) mitigates volumetric and protocol-level attacks, not application-layer injection or scripting attacks. NSGs (D) filter traffic by IP, port, and protocol at the network layer and cannot inspect HTTP payloads for SQLi or XSS.

Answer

Azure Firewall

Answer

Azure DDoS Protection

Answer

Network Security Groups (NSGs) on the subnet

Question 15

Refer to the exhibit. What is the effect of this Azure Policy definition?

Accepted Answer

It denies creation or update of storage accounts that do not enforce HTTPS traffic.. The correct option is B: it denies creation or update of storage accounts that do not enforce HTTPS traffic. An Azure Policy definition with a deny effect targeting the Microsoft.Storage/storageAccounts resource type and the supportsHttpsTrafficOnly property blocks any create or update request where that property is false or missing, enforcing secure transfer. Option A is wrong because the policy targets storage accounts, not virtual networks, and HTTPS enforcement is not a virtual network property. Option C is wrong because the effect is deny, not audit, so noncompliant requests are blocked rather than merely logged. Option D is wrong because the policy scope is the storage account resource itself, not the blob service child resource.

Answer

It denies creation of virtual networks that are not using HTTPS.

Answer

It audits storage accounts to check if HTTPS traffic is enforced.

Answer

It denies creation of blob services that do not enforce HTTPS.

Question 16

A company uses Microsoft Sentinel to detect threats. They want to automatically send an email to the security team when a high-severity incident is created. What should they configure?

Accepted Answer

An analytics rule with an automated response. The correct option is A, an analytics rule with an automated response, because in Microsoft Sentinel analytics rules generate incidents from detected events, and their automated response (via automation rules or playbooks triggered on incident creation) can send an email to the security team when a high-severity incident is created. This directly satisfies the requirement of automatic notification upon incident creation. A workbook (B) is only a visualization/reporting dashboard and does not trigger notifications. A watchlist (C) stores reference data for enrichment or correlation and cannot send emails. A hunting query (D) is a manual, proactive search for threats and does not automatically notify anyone.

Answer

A workbook

Answer

A watchlist

Answer

A hunting query

Question 17

A company uses Azure Front Door to publish a web application globally. They need to protect against DDoS attacks and web application attacks (SQL injection, XSS). Which two services should they enable in combination?

Accepted Answer

Azure DDoS Protection Standard and Azure WAF policy on Front Door. Azure DDoS Protection protects against volumetric DDoS attacks. Azure Web Application Firewall (WAF) in Front Door protects against application-layer attacks. Azure Firewall is for network-layer filtering. Network Security Groups (NSGs) are for subnet-level filtering. Azure DDoS Protection Standard is the correct tier.

Answer

Azure DDoS Protection Standard and Azure Firewall

Answer

Azure WAF on Application Gateway and Network Security Groups

Answer

Azure Firewall and Azure DDoS Protection Basic

Question 18

Your organization is adopting a Zero Trust security model. You need to design a solution that ensures continuous verification of user identity and device health before granting access to resources. Which Microsoft Entra ID feature should you prioritize?

Accepted Answer

Microsoft Entra ID Conditional Access. Conditional Access is the primary Microsoft Entra ID feature that enforces continuous verification by evaluating user identity, device health (via compliance policies or Microsoft Defender for Endpoint signals), location, and risk in real-time before granting access. It directly supports the Zero Trust principle of 'never trust, always verify' by requiring authentication and authorization at every access attempt, not just at the perimeter.

Answer

Microsoft Entra ID Domain Services

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Question 19

You are a security architect for a large financial services company. The company has a hybrid identity environment with on-premises Active Directory synchronized to Microsoft Entra ID using Microsoft Entra Connect. They use Microsoft 365 E5 licenses and have deployed Microsoft Defender for Cloud, Microsoft Defender for Identity, Microsoft Sentinel, and Microsoft Purview. The company has recently suffered a ransomware attack where an attacker gained access via a compromised service account that had permanent Global Administrator privileges. The attacker then used the account to create a backdoor user and exfiltrate sensitive data from SharePoint Online. After the incident, the CISO mandates a Zero Trust security transformation with the following requirements: 
1. Eliminate standing privileged access for all cloud admins.
2. Require phishing-resistant authentication for all privileged roles.
3. Ensure that all sensitive data in SharePoint Online is automatically classified and protected.
4. Enable detection of lateral movement using anomalous behavior analytics. Which combination of actions should you recommend?

Accepted Answer

Implement Privileged Identity Management (PIM) for Global Administrator roles, configure Authentication Strengths to require FIDO2, create auto-labeling policies for credit card numbers, and enable Defender for Identity lateral movement path detection.. It directly addresses all four CISO requirements: Privileged Identity Management (PIM) eliminates standing Global Administrator privileges by requiring just-in-time activation; Authentication Strengths with FIDO2 enforces phishing-resistant authentication for privileged roles; auto-labeling policies in Microsoft Purview automatically classify and protect sensitive data like credit card numbers in SharePoint Online; and Defender for Identity lateral movement path detection uses behavioral analytics to detect anomalous lateral movement, fulfilling the detection requirement.

Answer

Deploy Microsoft Entra Identity Protection for all users, configure Azure AD Conditional Access with MFA, use Microsoft Purview Information Protection with manual labeling, and enable Microsoft Sentinel analytics for lateral movement.

Answer

Configure Conditional Access to require MFA for admins, enable Microsoft Purview DLP for SharePoint, deploy Defender for Cloud Apps, and use Identity Protection for user risk.

Answer

Remove all permanent admin roles and use just-in-time access via PIM, enforce MFA via Conditional Access, apply sensitivity labels via Microsoft Purview Data Map, and use Microsoft Defender for Cloud for network security groups.

Question 20

Your organization uses Microsoft Sentinel and wants to correlate security events from multiple sources to detect multi-stage attacks. What should you create?

Accepted Answer

Fusion rule. Fusion rules in Microsoft Sentinel are specifically designed to correlate security events from multiple sources and detect multi-stage attacks by combining alerts from different detection technologies into a single incident. This matches the requirement to correlate events across sources for complex attack chains, unlike other rule types that focus on single-source or single-event detection.

Answer

Scheduled query rule

Answer

NRT rule

Answer

Anomaly rule