SC-100 Practice Exam 51 — 20 Questions

Question 1

A company is using Microsoft Defender for Cloud to secure their Azure environment. They have enabled the 'Defender for Cloud's integrated workload protection' plan for Azure SQL Database. Which TWO of the following security features are included in this plan?

Accepted Answer

Vulnerability assessment. Option A and D are correct. Option A: Vulnerability assessment is included in the Defender for SQL plan. Option D: Advanced Threat Protection (ATP) is included. Option B: Azure SQL Database always encrypts data at rest with TDE by default, but it is not a specific feature of the Defender plan. Option C: Information Protection is a Microsoft Purview feature, not Defender for Cloud. Option E: Azure Policy is a separate governance tool.

Answer

Microsoft Purview Information Protection

Answer

Azure Policy

Answer

Transparent Data Encryption (TDE)

Question 2

A company is implementing Microsoft Priva to manage subject rights requests. Users submit requests to access their personal data stored in Exchange Online, SharePoint, and Teams. The privacy team needs to automate the retrieval of data from these sources. Which Priva capability should they use?

Accepted Answer

Subject Rights Requests. Option C is correct because Priva Subject Rights Requests includes built-in data retrieval from Microsoft 365 sources. Option A is wrong because Data Inventory scans but does not retrieve data for requests. Option B is wrong because Consent Management handles consent, not data retrieval. Option D is wrong because Data Breach Notifications are for incident response.

Answer

Consent Management

Answer

Data Inventory

Answer

Data Breach Notifications

Question 3

Your organization uses Microsoft Sentinel to centralize security monitoring. You need to detect anomalous access to a critical Azure SQL Database from unusual geographic locations. Which data connector and analytic rule should you use?

Accepted Answer

Azure SQL Database connector and a custom scheduled query rule with geo-location. Option D is correct because the Azure SQL Database connector ingests diagnostic logs containing connection events, and an analytics rule can detect anomalies by location. Option A is wrong because Azure AD sign-in logs do not include database-level connections. Option B is wrong because Azure Activity logs track control plane operations, not data plane access. Option C is wrong because Windows Security Events are for on-premises servers, not Azure SQL.

Answer

Azure Active Directory connector and an anomaly rule for sign-ins

Answer

Windows Security Events connector and a rule for failed logins

Answer

Azure Activity connector and a rule for resource deletion

Question 4

Your company uses Microsoft Defender for Cloud Apps to protect its SaaS environment. You need to configure settings to detect and block risky user activities. Which TWO actions should you take? (Choose TWO.)

Accepted Answer

Configure anomaly detection policies.. Option B and Option D are correct. Enabling session monitoring allows real-time activity monitoring, and configuring anomaly detection policies helps detect risky behaviors. Option A is incorrect because blocking all third-party apps is too restrictive. Option C is incorrect because app discovery policies discover shadow IT, not detect risky user activities. Option E is incorrect because IP address ranges are for location-based policies, not core detection.

Answer

Block all third-party app access.

Answer

Define IP address ranges for trusted locations.

Answer

Configure app discovery policies.

Question 5

Your organization uses Microsoft Purview to classify and protect sensitive data. You need to prevent users from accidentally sharing files that contain credit card numbers via email. What should you configure in Microsoft Purview?

Accepted Answer

Implement a data loss prevention (DLP) policy that detects credit card numbers and blocks email sharing.. Data Loss Prevention (DLP) policies in Microsoft Purview can detect sensitive information types like credit card numbers and block sharing via email. Sensitivity labels can be applied automatically but do not block sharing by themselves. The correct answer is DLP policy.

Answer

Enable Microsoft Defender for Cloud Apps session policy to monitor file downloads.

Answer

Configure a retention policy for files containing credit card numbers.

Answer

Create a sensitivity label that automatically classifies credit card numbers.

Question 6

A software company, Northwind, is developing a mobile app that uses Microsoft Entra ID for authentication. The app accesses an Azure Function App backend that stores data in Azure Cosmos DB. The company wants to implement a defense-in-depth security strategy. Which TWO of the following should you implement?

Accepted Answer

Use OAuth 2.0 with Microsoft Entra ID to secure the Azure Functions.. Option B is correct because OAuth 2.0 with Entra ID provides user authentication and authorization. Option E is correct because Cosmos DB should be configured with a private endpoint to prevent public internet access. Option A is wrong because function keys are not user-specific. Option C is wrong because IP whitelisting is not sufficient for user authentication. Option D is wrong because TLS 1.0 is deprecated.

Answer

Restrict access to the Azure Functions by IP whitelisting.

Answer

Use function-level authorization keys for the Azure Functions.

Answer

Enforce TLS 1.0 for all API calls.

Question 7

Refer to the exhibit. What is the effect of this Azure Policy definition?

Accepted Answer

It denies creation or update of storage accounts that do not enforce HTTPS traffic.. Option A is correct. The policy checks if the storage account does not have 'Secure transfer required' enabled (supportsHttpsTrafficOnly equals false) and denies creation or update. Option B is wrong because the effect is 'deny', not 'audit'. Option C is wrong because the condition is on storage accounts, not on virtual networks. Option D is wrong because the policy does not apply to blob services.

Answer

It denies creation of virtual networks that are not using HTTPS.

Answer

It audits storage accounts to check if HTTPS traffic is enforced.

Answer

It denies creation of blob services that do not enforce HTTPS.

Question 8

Your company uses Microsoft Defender for Cloud Apps to discover shadow IT. You need to ensure that data exfiltration from sanctioned cloud apps is blocked in real-time. Which control should you configure?

Accepted Answer

Conditional Access App Control. Option C is correct because session-based Conditional Access App Control enforces real-time monitoring and control of app sessions. Option A is wrong because app connectors provide read-only monitoring. Option B is wrong because cloud discovery only identifies apps, not controls. Option D is wrong because IP address ranges are used for location policies, not session control.

Answer

IP address ranges

Answer

Cloud discovery

Answer

App connector

Question 9

You are reviewing an ARM template snippet that creates a blob container. The security team requires that the container be accessible only via authorized Azure AD identities, not via anonymous access. Based on the exhibit, is the configuration correct?

Accepted Answer

Yes, the setting 'publicAccess': 'None' prevents anonymous access, and Azure AD authentication is available by default. Option B is correct because 'publicAccess': 'None' ensures no anonymous access, and Azure AD authentication is the default for authorized identities. Option A is wrong because the configuration is correct. Option C is wrong because container-level access is not a separate setting. Option D is wrong because RBAC is already the default for authorized identities; no additional action needed.

Answer

Yes, but you also need to disable shared key access

Answer

No, you need to set 'publicAccess' to 'Blob' to restrict access

Answer

No, you must also configure a firewall rule to restrict access to Azure AD users

Question 10

Your organization uses Microsoft Intune to manage devices. You need to deploy a line-of-business (LOB) app to iOS devices that is not available in the public App Store. The app is signed with an enterprise certificate. Which app deployment method should you use?

Accepted Answer

iOS line-of-business app deployment in Intune. Option D is correct because Intune can deploy LOB apps to iOS devices using enterprise certificate signing and MDM distribution. Option A is wrong because the VPP store only contains public apps. Option B is wrong because Android Enterprise is not for iOS. Option C is wrong because Microsoft Store for Business is for Windows apps.

Answer

Android Enterprise managed Google Play

Answer

Volume Purchase Program (VPP) token

Answer

Microsoft Store for Business

Question 11

Your organization is designing a security solution for a new web application that will be deployed on Azure App Service. The application will access an Azure SQL Database and an Azure Storage account. The security requirements include: (1) use managed identities for authentication, (2) encrypt data at rest and in transit, (3) restrict network access to the database and storage account to only the App Service, and (4) use Azure Key Vault for secrets management. Which TWO of the following should you implement?

Accepted Answer

Configure private endpoints for the SQL Database and Storage account.. Option A and Option D are correct. Managed identities allow the App Service to authenticate to other Azure services without credentials. Private endpoints provide network isolation. Option B is wrong because connection strings with access keys negate the use of managed identities. Option C is wrong because service endpoints are less secure than private endpoints and do not provide the same level of isolation. Option E is wrong because SAS tokens are not recommended when managed identities are available.

Answer

Configure the App Service to use a connection string with a storage account access key.

Answer

Use shared access signatures (SAS) for the App Service to access the Storage account.

Answer

Configure service endpoints for the SQL Database and Storage account.

Question 12

A healthcare organization uses Microsoft Purview Information Protection to classify and protect patient data. They want to automatically apply a 'High Confidentiality' label to any document containing a patient ID pattern (###-####). The label should also encrypt the document. Which configuration should they use?

Accepted Answer

Sensitivity label with auto-labeling for sensitive info types. Option B is correct because a sensitivity label with auto-labeling for files containing sensitive info types (like patient IDs) can apply encryption automatically. Option A is wrong because a retention label only manages retention, not encryption. Option C is wrong because a DLP policy alerts but does not automatically label. Option D is wrong because a trainable classifier requires training and does not use a regex pattern.

Answer

Retention label with auto-labeling policy

Answer

Data Loss Prevention (DLP) policy with a block action

Answer

Trainable classifier with a retention policy

Question 13

Your company uses Microsoft Sentinel for security operations. You need to design a solution that automatically remediates a detected threat by blocking a malicious IP address on Azure Firewall. Which Microsoft Sentinel feature should you use?

Accepted Answer

SOAR playbooks. Option C is correct because Security Orchestration, Automation, and Response (SOAR) in Microsoft Sentinel uses playbooks to automate remediation actions like blocking IPs on Azure Firewall. Option A is wrong because analytics rules only generate alerts. Option B is wrong because workbooks visualize data. Option D is wrong because UEBA analyzes behavior but does not automate remediation.

Answer

Analytics rules

Answer

Workbooks

Answer

User and Entity Behavior Analytics (UEBA)

Question 14

Your company, Fabrikam, is designing a solution to securely store and manage secrets (e.g., API keys, database passwords) for cloud applications. The solution must use Azure Key Vault and support automatic rotation of secrets. The applications will run on Azure VMs and Azure App Service. Which TWO of the following should you include in your design?

Accepted Answer

Implement automatic secret rotation using Key Vault with Event Grid and Azure Functions.. Option B is correct because managed identities allow VMs and App Service to authenticate to Key Vault without storing credentials. Option D is correct because Key Vault can rotate secrets automatically using Event Grid and Azure Functions. Option A is wrong because storing secrets in application configuration is insecure. Option C is wrong because service principals require credential management. Option E is wrong because Azure Automation is not designed for secret rotation.

Answer

Use service principals with client secrets to authenticate to Key Vault.

Answer

Rotate secrets manually using Azure Automation runbooks on a schedule.

Answer

Store secrets in application configuration files encrypted with Azure Key Vault.

Question 15

Your company uses Microsoft Intune to manage mobile devices. You need to ensure that corporate data in Microsoft 365 apps cannot be copied to personal apps on the same device. What should you configure?

Accepted Answer

App protection policy (MAM) with 'Restrict cut, copy, and paste'. Option C is correct because app protection policies (MAM) can prevent data transfer between managed and unmanaged apps. Option A is wrong because conditional access blocks access but does not control copy/paste. Option B is wrong because compliance policies enforce device health, not app-level data movement. Option D is wrong because device configuration profiles set device settings, not app restrictions.

Answer

Conditional Access policy requiring compliant device

Answer

Device configuration profile with restrictions

Answer

Device compliance policy for mobile devices

Question 16

Your organization uses Microsoft Entra ID and plans to implement a custom line-of-business application that accesses Microsoft Graph APIs. The application will be used by employees and external partners. You need to ensure that the application can authenticate users and obtain appropriate permissions without exposing the client secret. What should you implement?

Accepted Answer

Implement OAuth 2.0 authorization code flow with PKCE.. Managed identities are not suitable for client applications that run outside Azure. Using certificates instead of client secrets enhances security but still requires secret management. OAuth 2.0 authorization code flow with PKCE is the recommended approach for mobile and desktop apps, but for a web app with a backend, the best practice is to use a system-assigned managed identity if hosted in Azure, or use certificates/Key Vault. However, the question specifies a custom LOB app used by employees and external partners, likely hosted on-premises or in Azure. The most secure approach for a confidential client is to use a certificate stored in Azure Key Vault. But the correct answer here is to implement OAuth 2.0 authorization code flow with PKCE (Proof Key for Code Exchange) to avoid exposing the client secret in the browser. For a web app with a backend, using the authorization code flow with PKCE is still recommended, and the client secret is not exposed. Option D is the most accurate.

Answer

Use a system-assigned managed identity to authenticate to Microsoft Graph.

Answer

Store the client secret in Azure Key Vault and retrieve it at runtime.

Answer

Register the application as a public client and use the implicit grant flow.

Question 17

Your organization uses Microsoft Defender for Cloud Apps to protect SaaS applications. You need to configure a policy that blocks downloads of files tagged as 'Highly Confidential' from SharePoint Online and triggers an automated investigation. Which policy type should you use?

Accepted Answer

Access policy. Option C is correct because an access policy in Defender for Cloud Apps can enforce real-time controls like blocking downloads based on sensitivity labels. Option A is wrong because session policy controls user sessions but does not natively block downloads by label. Option B is wrong because app discovery policy discovers shadow IT, not controls access. Option D is wrong because anomaly detection policy detects unusual behavior but does not block downloads.

Answer

Session policy

Answer

App discovery policy

Answer

Anomaly detection policy

Question 18

Your organization, Contoso Ltd., is a multinational company with 50,000 employees. They use Microsoft 365 E5, Azure, and Microsoft Sentinel. The security team wants to implement a data security solution that meets the following requirements:

1. All sensitive data stored in SharePoint Online and OneDrive for Business must be automatically classified and protected using sensitivity labels.
2. When a user attempts to share a file labeled 'Highly Confidential' with an external user, the action should be blocked and an alert sent to the security team.
3. The solution must detect and prevent data exfiltration from endpoints by monitoring copy/paste and print actions on sensitive data.
4. All data security events must be centralized in Microsoft Sentinel for correlation and investigation.
5. The solution must comply with regulatory requirements that mandate data retention and eDiscovery capabilities.

You need to design the data security solution. Which combination of Microsoft security components should you use?

Accepted Answer

Microsoft Purview Information Protection, Microsoft Purview DLP, and Microsoft Purview eDiscovery. Option D is correct. Microsoft Purview Information Protection auto-labeling policies meet requirement 1. DLP policies in Purview block sharing and alert (requirement 2). Endpoint DLP in Purview monitors copy/paste/print (requirement 3). Purview audit logs are ingested into Microsoft Sentinel (requirement 4). Microsoft Purview eDiscovery and retention policies meet requirement 5. Option A is wrong because Microsoft Defender for Cloud Apps does not provide endpoint DLP or eDiscovery. Option B is wrong because Microsoft Intune does not provide DLP or eDiscovery. Option C is wrong because Microsoft Defender for Endpoint focuses on endpoint protection, not data classification or eDiscovery.

Answer

Microsoft Intune and Microsoft Entra ID

Answer

Microsoft Defender for Endpoint and Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps and Microsoft Entra ID

Question 19

You are designing a solution to protect an Azure App Service web app that authenticates users via Microsoft Entra ID. The app needs to ensure that only users from specific external partner organizations can access it. You do not want to create user objects for each partner user in your tenant. What should you configure?

Accepted Answer

Enable Microsoft Entra B2B collaboration and configure the application to accept tokens from partner tenants.. B2B collaboration allows external users to use their own identities without creating separate user objects. B2C is for customer-facing apps. Conditional Access policies can restrict access but require user objects. Application permissions are for app-to-app scenarios. Option D is correct.

Answer

Configure a Conditional Access policy that restricts access to partners' IP ranges.

Answer

Create guest user accounts for each external user and assign them to a group.

Answer

Use Azure AD B2C custom policies to allow partner authentication.

Question 20

Which THREE actions should you take to secure a CI/CD pipeline using Azure DevOps and GitHub?

Accepted Answer

Enable secret scanning in GitHub to detect leaked credentials. Options A, D, and E are correct. Using secure variables, branch protection rules, and secret scanning are key security measures. Option B is wrong because disabling code review reduces security. Option C is wrong because running pipelines with admin privileges increases risk.

Answer

Run all pipeline tasks with administrative privileges

Answer

Disable pull request code reviews to speed deployment