SC-100 Practice Exam 53 — 20 Questions

Question 1

Refer to the exhibit. You are reviewing an ARM template for an Azure storage account. The security team requires that only HTTPS traffic is allowed and that TLS 1.2 is enforced. Does this template meet the requirements?

Accepted Answer

Yes, the template correctly enforces HTTPS and TLS 1.2. Option D is correct because the ARM template sets 'supportsHttpsTrafficOnly' to true, which enforces HTTPS-only traffic, and 'minimumTlsVersion' to 'TLS1_2', which enforces TLS 1.2 as the minimum protocol version. These two properties together fully satisfy the security team's requirement that only HTTPS traffic is allowed and TLS 1.2 is enforced.

Answer

No, because 'minimumTlsVersion' should be 'TLS1_0'

Answer

No, because 'supportsHttpsTrafficOnly' should be false

Answer

No, because 'defaultAction': 'Deny' blocks all traffic including HTTPS

Question 2

Your organization uses Microsoft Entra ID and needs to ensure that external partners can access only specific applications for 30 days. What should you configure?

Accepted Answer

Entitlement management and create an access package with an expiration of 30 days. Option A is correct because entitlement management in Microsoft Entra ID allows you to create access packages that govern external partner access to specific applications. By configuring an access package with a 30-day expiration, you enforce time-limited access, ensuring partners can only access the designated applications for the required duration. This directly meets the requirement of restricting access to specific apps with a defined expiry.

Answer

B2B direct connect

Answer

Self-service group management

Answer

Conditional Access policy with session control

Question 3

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Sentinel. You need to create an analytics rule in Sentinel that triggers an incident when a device is reported as 'high risk' by MDE. Which data source and rule type should you use?

Accepted Answer

Microsoft Defender XDR connector with a Scheduled query rule. The Microsoft Defender XDR connector ingests alerts from Microsoft Defender for Endpoint (MDE) into Sentinel. A Scheduled query rule is required to run a KQL query at a defined interval (e.g., every 5 minutes) that checks for devices with a 'high risk' severity level in the ingested alert data. This combination allows you to create an incident when MDE reports a device as high risk.

Answer

Microsoft Sentinel's Anomalous Activity rule

Answer

Microsoft 365 Defender connector with an NRT query rule

Answer

Microsoft Defender for Cloud connector with a Fusion rule

Question 4

A company is planning to use Azure Logic Apps to integrate multiple SaaS applications. The workflow will process sensitive customer data and must comply with data residency requirements, ensuring that data does not leave a specific Azure region. The solution must minimize latency. What is the recommended deployment strategy?

Accepted Answer

Provision an Integration Service Environment (ISE) in the required region and deploy Logic Apps into it.. Option D is correct because an Integration Service Environment (ISE) is a dedicated, isolated instance of the Azure Logic Apps runtime that runs in your own virtual network, ensuring data never leaves the specified Azure region. This meets strict data residency requirements while minimizing latency by keeping all processing within the same regional boundary. The ISE also provides dedicated compute resources, avoiding multi-tenant contention and reducing network hops.

Answer

Use Azure API Management to route traffic to Logic Apps in the required region.

Answer

Deploy Logic Apps using the Standard plan in the required region.

Answer

Deploy Logic Apps using the Consumption plan in the required region.

Question 5

A SOC analyst needs to investigate a potential privilege escalation using Azure AD roles. Which Microsoft 365 Defender data source would be most useful to review?

Accepted Answer

Azure Active Directory audit logs. Azure AD audit logs (now part of the Azure Monitor / Microsoft Entra audit logs) are the authoritative source for tracking changes to Azure AD roles, including role assignments, activations of Privileged Identity Management (PIM) roles, and modifications to directory roles. Since the question specifically involves privilege escalation using Azure AD roles, these logs contain the necessary details such as who assigned a role, when, and from which IP address, making them the most directly relevant data source.

Answer

Microsoft 365 Defender identity logs

Answer

Microsoft Defender for Cloud Apps logs

Answer

Microsoft 365 audit logs

Question 6

Which TWO actions align with the Zero Trust principle of 'verify explicitly'? (Select two.)

Accepted Answer

Use conditional access policies to evaluate user and device risk before granting access. Option B is correct because conditional access policies evaluate real-time signals such as user identity, device compliance, location, and risk level before granting access to resources. This aligns with the Zero Trust principle of 'verify explicitly' by requiring continuous validation of every access request rather than trusting based on network location alone.

Answer

Deploy a VPN for remote access

Answer

Encrypt all data at rest

Answer

Implement network segmentation to limit lateral movement

Question 7

Refer to the exhibit. A company creates this Azure Policy definition and assigns it to a subscription. A developer attempts to create a storage account with blob encryption enabled. The creation fails. What is the most likely reason?

Accepted Answer

The field path for blob encryption is case-sensitive and may not match the actual property. The policy definition uses the field path `Microsoft.Storage/storageAccounts/encryption.services.blob.enabled` to check for blob encryption. Azure Resource Manager property paths are case-sensitive, and the actual property for blob encryption is `Microsoft.Storage/storageAccounts/encryption.services.blob.enabled` with lowercase 'b' in 'blob'. If the path in the policy uses incorrect casing (e.g., 'Blob' with capital B), the policy engine cannot match the property, causing the deny effect to trigger incorrectly or fail to evaluate properly, leading to creation failure.

Answer

The policy effect is set to 'deny' but should be 'audit'

Answer

The policy uses 'allOf' incorrectly; it should use 'anyOf'

Answer

The field path is not a valid Azure Resource Manager path

Question 8

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

Identify the top 10 users who have been targeted by Mimikatz attacks. The KQL query uses the `summarize` operator with `count()` to aggregate Mimikatz alerts by `UserPrincipalName`, then sorts the results by count in descending order and limits the output to 10 rows. This directly identifies the top 10 users who have been targeted by Mimikatz attacks, as each alert represents a detection event associated with a specific user.

Answer

Show the severity of Mimikatz alerts for each user

Answer

List all Mimikatz alerts with detailed entity information

Answer

Count the total number of Mimikatz alerts in the last 7 days

Question 9

Refer to the exhibit. An Azure policy is defined as shown. Which resources will be audited?

Accepted Answer

Virtual machines with Standard_LRS managed disks. The Azure policy definition in the exhibit uses the 'auditIfNotExists' effect with a condition that checks if the 'Microsoft.Compute/virtualMachines' resource type has a 'Microsoft.Compute/disks' resource of type 'Standard_LRS' associated. This means the policy audits virtual machines that do NOT have a managed disk of type Standard_LRS, effectively auditing VMs with unmanaged disks or other managed disk SKUs. Option C is correct because the policy specifically targets virtual machines with Standard_LRS managed disks for audit, as the condition evaluates to true when the disk type is Standard_LRS, triggering the audit effect.

Answer

All Azure resources that are not compliant

Answer

All virtual machines with unmanaged disks

Answer

Virtual machines with Premium_LRS managed disks and disk size 1024 GB

Question 10

Refer to the exhibit. You are reviewing a Conditional Access policy JSON. What is the effect of this policy?

Accepted Answer

Blocks sign-ins from users with high user risk. The policy JSON specifies `"userRiskLevels": ["high"]` under the conditions block, which means it targets only users whose user risk level is assessed as high by Microsoft Entra ID Protection. The grant control is set to `"builtInControls": ["block"]`, so the policy blocks sign-ins for those high-risk users. Option B is correct because the policy explicitly blocks sign-ins from users with high user risk, not sign-in risk or all users.

Answer

Blocks sign-ins from locations with high sign-in risk

Answer

Blocks all sign-ins from any user

Answer

Requires multifactor authentication for high-risk users

Question 11

An organization uses Microsoft Purview to classify and protect sensitive data. Which THREE capabilities can be used to discover sensitive data? (Choose three.)

Accepted Answer

Trainable classifiers. Trainable classifiers use machine learning to identify content based on patterns and context, not just exact matches. They can be trained on sample data to recognize custom sensitive information, such as specific contract clauses or internal project codes, enabling discovery of sensitive data that predefined sensitive information types might miss.

Answer

Data loss prevention policies

Answer

Retention labels

Question 12

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

Identify accounts that have experienced more than 10 failed login attempts from the same IP address within an hour. The KQL query uses the `summarize` operator to count failed logon events (EventID 4625) grouped by account and IP address, then filters for counts greater than 10 within a 1-hour time window. This directly identifies accounts that have experienced more than 10 failed login attempts from the same IP address within an hour, which is a classic indicator of a brute-force attack targeting a specific account.

Answer

Identify IP addresses that have successfully brute-forced an account

Answer

Identify users who have logged in from multiple IPs in a short time

Answer

Identify accounts that have been disabled due to multiple failures

Question 13

Refer to the exhibit. You are reviewing an ARM template for a storage account. The security team has mandated that all storage accounts must enforce HTTPS traffic and use TLS 1.2 or higher. Which two changes must be made to the template to comply? (Choose two.)

Accepted Answer

Change 'minimumTlsVersion' to 'TLS1_2'. Option A is correct because setting 'minimumTlsVersion' to 'TLS1_2' explicitly enforces that only TLS 1.2 or higher is accepted for HTTPS connections to the storage account, meeting the security mandate. Option E is correct because setting 'supportsHttpsTrafficOnly' to true ensures that all traffic to the storage account must use HTTPS, blocking any HTTP requests and aligning with the requirement to enforce HTTPS traffic.

Answer

Set 'kind' to 'BlobStorage'

Answer

Add 'networkAcls' with defaultAction Deny

Answer

Change 'sku.name' to 'Standard_LRS'

Question 14

Your organization plans to use Microsoft Purview to protect sensitive data in Microsoft 365. The compliance team needs to detect when users share credit card numbers via email and automatically apply encryption. Which solution should you implement?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect sensitive data types—such as credit card numbers—in email messages and automatically apply protective actions like encryption. DLP policies can inspect email content in transit via Exchange Online, match patterns against predefined sensitive info types (e.g., credit card number regex), and trigger actions such as 'Encrypt the message' using Azure Rights Management. This directly meets the requirement to detect sharing of credit card numbers and enforce encryption automatically.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Information Protection

Question 15

Which TWO are best practices for securing Microsoft Entra ID?

Accepted Answer

Use a Conditional Access policy to require MFA for all users. Option A is correct because requiring MFA via Conditional Access is a foundational security control that mitigates the risk of credential theft. Conditional Access policies allow granular enforcement based on user, location, device, and risk signals, making them more flexible than security defaults while still ensuring MFA is applied to all users.

Answer

Disable sign-in logs to reduce storage costs

Answer

Allow users to create Microsoft 365 groups without approval

Answer

Assign Global Administrator to all users for simplicity

Question 16

Refer to the exhibit. A KQL query is used in Microsoft Sentinel to detect brute-force attacks. The query returns no results despite known brute-force attempts. What is the most likely issue?

Accepted Answer

The EventID 4625 may not cover all authentication failures. EventID 4625 in Windows Security logs specifically records failed logon attempts, but brute-force attacks may target other authentication protocols (e.g., RDP, SMB, or network-level authentication) that generate different EventIDs (such as 4648, 4776, or 5156). Additionally, some brute-force attempts might be blocked at the network layer or use non-Windows authentication methods, so relying solely on EventID 4625 will miss those events. Therefore, the query returns no results because it does not capture all authentication failure scenarios.

Answer

The query lacks a time filter

Answer

The 'IPAddress' field does not exist in SecurityEvent

Answer

The 'count()' aggregation is incorrect

Question 17

Your company uses Microsoft Defender for Cloud to manage security posture across hybrid workloads. You need to ensure that critical vulnerabilities found on Azure VMs are automatically remediated without manual intervention. Which feature should you enable?

Accepted Answer

Enable 'Remediate' for security recommendations in Defender for Cloud. Option A is correct because Microsoft Defender for Cloud's 'Remediate' feature allows you to automatically apply the necessary configuration changes or deploy the required patches to fix critical vulnerabilities on Azure VMs without manual intervention. This is achieved by enabling the 'Remediate' option on specific security recommendations, which triggers an automated workflow (often using Azure Policy or a custom script) to resolve the identified issue. This directly addresses the requirement for automatic remediation of critical vulnerabilities.

Answer

File Integrity Monitoring (FIM)

Answer

Microsoft Defender for Cloud's Regulatory Compliance dashboard

Answer

Azure Automation Update Management

Question 18

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel. The query returns a list of users and IP addresses with failed sign-ins due to 'User Account Disabled' (ResultType 50057). The analyst wants to create a scheduled analytics rule that generates an incident when a user exceeds 5 such failures from the same IP in an hour. Which setting is missing from the query to meet the requirement?

Accepted Answer

Add a 'bin' or 'bin_at' to group by time windows.. The query currently returns all failed sign-ins due to 'User Account Disabled' but does not aggregate them into time-based windows. To meet the requirement of generating an incident when a user exceeds 5 failures from the same IP in an hour, the query must group the results into 1-hour time buckets using 'bin' or 'bin_at' on the timestamp column, then count the failures per user and IP per bucket, and filter for counts greater than 5. Without this time-windowing, the query cannot enforce the 'in an hour' condition.

Answer

Add a 'let' statement to define the threshold.

Answer

Add a 'project' to select columns.

Answer

Add a 'where' clause to filter by ResultType.

Question 19

Which THREE conditions can trigger a Microsoft Entra ID Protection user risk policy to require a password change?

Accepted Answer

Leaked credentials detected on the dark web.. Option A is correct because Microsoft Entra ID Protection's user risk policy can be triggered by leaked credentials detected on the dark web. When Microsoft's threat intelligence services find a user's credentials exposed in a known data breach, the user's risk level is elevated, and the policy can be configured to require a password change as a remediation action to mitigate the compromised account.

Answer

User has not registered for multi-factor authentication.

Answer

Device is marked as non-compliant by Intune.

Question 20

The exhibit shows a KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

Identify the most frequent high-severity alerts over the past week. The query uses `summarize` with `count()` and `top 5 by count_ desc` to rank alert names by frequency, filtered to `AlertSeverity == 'High'` and `TimeGenerated > ago(7d)`. This directly identifies the most common high-severity alerts over the past week, making option C correct.

Answer

Find alerts that were not investigated

Answer

Analyze entities associated with alerts

Answer

Correlate alerts by time and alert name

SC-100 Practice Exam 53 — 20 Questions

Exhibit

SC-100 Practice Exam 53 — 20 Questions

Exhibit