SC-100 Practice Exam 55 — 20 Questions

Question 1

Your organization is using Microsoft Defender for Cloud to assess the security posture of Azure resources. You need to ensure that the highest severity recommendations are addressed first. Which dashboard or feature in Defender for Cloud should you use to view the most critical security issues?

Accepted Answer

Secure Score. The Secure Score dashboard in Microsoft Defender for Cloud provides a prioritized list of security recommendations based on their impact on your overall security posture. By sorting recommendations by score impact, you can identify and address the highest severity issues first, as they contribute most significantly to improving your secure score.

Answer

Azure Security Center dashboard

Answer

Inventory

Answer

Security alerts

Question 2

Which TWO of the following are features of Microsoft Defender for Cloud that help secure infrastructure? (Choose two.)

Accepted Answer

Secure Score. Secure Score (A) is a feature of Microsoft Defender for Cloud that aggregates security findings across your Azure subscriptions and provides a numerical score based on the implementation of security controls. It helps prioritize remediation actions by showing the potential score improvement for each recommendation, directly enabling infrastructure hardening.

Answer

Incident investigation

Answer

Privileged Identity Management

Answer

User and Entity Behavior Analytics (UEBA)

Question 3

A company is adopting Microsoft Purview for data security. They need to prevent users from sharing sensitive data like credit card numbers via email. Which feature should you configure?

Accepted Answer

Data Loss Prevention (DLP) policy. Data Loss Prevention (DLP) policies in Microsoft Purview are specifically designed to detect and prevent the accidental or intentional sharing of sensitive information, such as credit card numbers, through email and other channels. By configuring a DLP policy with a rule that scans for credit card number patterns (using predefined or custom sensitive info types), the system can block, quarantine, or notify users when such data is sent via Exchange Online. This directly addresses the requirement to prevent sharing sensitive data via email.

Answer

Audit log search

Answer

Insider Risk Management policy

Answer

Sensitivity labels

Question 4

A company uses Microsoft Sentinel and wants to use a built-in connector to ingest logs from Amazon Web Services (AWS). Which connector should they use?

Accepted Answer

Amazon Web Services S3 connector. The Amazon Web Services (AWS) S3 connector is the correct built-in connector in Microsoft Sentinel for ingesting logs from AWS. It works by configuring AWS to send logs (such as CloudTrail, VPC Flow Logs, or GuardDuty findings) to an S3 bucket, which Sentinel then polls via the S3 REST API using an IAM role for secure, cross-account access. This is the native, supported method for log ingestion from AWS into Sentinel.

Answer

ServiceNow connector

Answer

Azure Policy for AWS

Answer

Office 365 connector

Question 5

You are designing a security solution for Azure resources. You need to ensure that any changes to network security groups (NSGs) are automatically logged and sent to a central Log Analytics workspace. Which Azure feature should you use?

Accepted Answer

Diagnostic settings on the Azure Activity Log. Diagnostic settings on the Azure Activity Log capture all control-plane operations, including changes to NSGs (e.g., rule additions or deletions). By configuring a diagnostic setting to stream the Activity Log to a Log Analytics workspace, you ensure that every NSG modification is automatically logged and centralized for monitoring and alerting.

Answer

Azure Policy

Answer

NSG flow logs

Answer

Azure Monitor alerts

Question 6

Your enterprise uses Microsoft Defender for Cloud to secure a hybrid cloud environment spanning Azure and AWS. You need to design a solution that prioritizes remediation of the most critical vulnerabilities across both clouds based on Common Vulnerability Scoring System (CVSS) scores, exploitability, and business impact. Which Defender for Cloud feature should you use?

Accepted Answer

Security Explorer. Security Explorer (now part of Microsoft Defender for Cloud's Cloud Security Explorer) provides a graph-based query interface that allows you to identify and prioritize vulnerabilities across Azure and AWS based on CVSS scores, exploitability, and business impact. It enables you to filter by multiple dimensions (e.g., internet exposure, data sensitivity, attack path) to pinpoint the most critical risks, directly addressing the requirement to prioritize remediation across both clouds.

Answer

Regulatory Compliance Dashboard

Answer

Secure Score

Answer

Adaptive Application Controls

Question 7

Which TWO actions should you take to implement a defense-in-depth strategy for an Azure application? (Choose two.)

Accepted Answer

Enable Azure DDoS Protection on the virtual network. Option B is correct because Azure DDoS Protection provides defense against volumetric network-layer attacks, which is a critical component of a defense-in-depth strategy. By enabling it on the virtual network, you add a layer of protection at the network perimeter, complementing other security controls. This aligns with the principle of layered security, where multiple controls address different attack vectors.

Answer

Enable encryption at rest for all storage accounts

Answer

Enable Azure Firewall on all subnets

Answer

Use managed identities for Azure resources

Question 8

Your organization is adopting Microsoft Purview to classify and protect sensitive data in Microsoft 365. You need to ensure that documents containing credit card numbers are automatically detected and encrypted when shared externally. What should you configure?

Accepted Answer

A sensitivity label configured with auto-labeling for credit card numbers and encryption for external sharing. Option B is correct because sensitivity labels in Microsoft Purview can be configured with auto-labeling conditions that detect sensitive data types (e.g., credit card numbers) and automatically apply encryption to documents when shared externally. This meets the requirement of automatic detection and encryption for external sharing without manual user intervention.

Answer

An Information Barrier policy between departments

Answer

A retention label that deletes documents with credit card numbers after 90 days

Answer

A Data Loss Prevention (DLP) policy that blocks sharing of credit card numbers

Question 9

Your organization uses Microsoft Intune to manage devices. You need to ensure that devices that are not compliant with your organization's security policies are blocked from accessing corporate resources. Which Intune feature should you configure?

Accepted Answer

Compliance policies. Compliance policies in Microsoft Intune define the rules and settings that devices must meet to be considered compliant (e.g., requiring a minimum OS version, encryption, or a healthy device health attestation). When a device is marked as non-compliant, Intune can automatically block access to corporate resources such as Exchange Online, SharePoint, or VPN by integrating with Conditional Access in Microsoft Entra ID. This is the correct feature because it directly evaluates device compliance and enforces access control.

Answer

App protection policies

Answer

Device configuration profiles

Answer

Enrollment restrictions

Question 10

A company uses Microsoft Defender for Endpoint (MDE) and needs to ensure that all devices report their security configuration to Microsoft Defender XDR. Which setting should they verify?

Accepted Answer

Devices are onboarded to Microsoft Defender XDR. Devices must be onboarded to Microsoft Defender XDR to report their security configuration. Onboarding registers the device with the Defender for Endpoint service, enabling the collection and forwarding of security telemetry to the Microsoft 365 Defender portal. Without onboarding, the device cannot communicate its security state, regardless of other integrations.

Answer

Devices are enrolled in Microsoft Intune

Answer

Microsoft Sentinel is connected to Defender for Endpoint

Answer

Microsoft Purview Information Protection is enabled

Question 11

A security architect is designing a solution to detect and respond to advanced threats across email, endpoints, and identities. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (Extended Detection and Response) is the correct solution because it provides unified pre- and post-breach detection, investigation, and response across email, endpoints, and identities. It correlates signals from Microsoft Defender for Endpoint, Defender for Office 365, and Defender for Identity into a single incident queue, enabling automated remediation of advanced multi-vector attacks.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 12

Your organization is deploying Microsoft Copilot for Security and wants to ensure that the AI model does not expose sensitive data in its responses. You need to configure data loss prevention (DLP) policies that apply to Copilot interactions. Which Microsoft Purview capability should you use?

Accepted Answer

Communication Compliance. Communication Compliance in Microsoft Purview is specifically designed to detect and prevent sensitive data exposure in communication channels, including Microsoft Copilot for Security interactions. It allows you to configure policies that scan AI prompts and responses for sensitive information, such as credit card numbers or confidential business data, and take automated actions like blocking or alerting. This makes it the correct capability for DLP in Copilot contexts, as it directly addresses the risk of AI models inadvertently leaking sensitive data.

Answer

eDiscovery

Answer

Data Loss Prevention policies

Answer

Information Protection and sensitivity labels

Question 13

Your organization uses Microsoft Defender for Cloud to protect a multi-cloud environment (Azure, AWS, GCP). You need to ensure that security configurations are assessed against industry benchmarks like CIS and PCI DSS. Which THREE actions should you take?

Accepted Answer

Enable the regulatory compliance dashboard in Defender for Cloud and select the desired standards (CIS, PCI DSS).. Option A is correct because the regulatory compliance dashboard in Microsoft Defender for Cloud allows you to add built-in standards such as CIS and PCI DSS. Once enabled, Defender for Cloud automatically assesses your multi-cloud resources against the selected benchmarks and provides a compliance score with detailed recommendations for remediation.

Answer

Deploy Azure Firewall in each cloud environment to filter traffic.

Answer

Deploy the Log Analytics agent to all VMs in the multi-cloud environment.

Question 14

Your organization is adopting Microsoft Copilot for Security. You need to ensure that the AI model does not expose sensitive data during interactions. What is the primary security control you should implement?

Accepted Answer

Microsoft Purview Data Loss Prevention policies for Copilot. Microsoft Purview Data Loss Prevention (DLP) policies for Copilot for Security are the primary control to prevent sensitive data exposure because they can inspect and block sensitive information (e.g., credit card numbers, health records) in real-time during Copilot interactions. DLP policies integrate directly with Copilot to enforce data protection rules on both prompts and responses, ensuring that sensitive data is not leaked through the AI model. This is the most direct and effective control for preventing data exposure in AI interactions.

Answer

Microsoft Entra Conditional Access policies

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Purview Information Protection sensitivity labels

Question 15

Your organization uses Microsoft Entra ID and plans to implement a Zero Trust security model. You need to ensure that all access requests to corporate applications are continuously evaluated based on user risk, device compliance, and location. Which Microsoft Entra ID feature should you configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it enables real-time policy evaluation of access requests based on signals such as user risk (from Identity Protection), device compliance (via Microsoft Intune), and location (IP address ranges or named locations). This aligns directly with the Zero Trust principle of 'never trust, always verify' by continuously re-evaluating each access attempt rather than relying on static permissions.

Answer

Identity Governance

Answer

Privileged Identity Management (PIM)

Answer

Identity Protection

Question 16

A company uses Microsoft Entra ID Governance. They need to automate the process of granting access to a SaaS application based on the user's department attribute. Which feature should they use?

Accepted Answer

Entitlement management. Entitlement management in Microsoft Entra ID Governance allows you to create access packages that define collections of resources (like SaaS apps) and policies for who can request access. By configuring a dynamic membership rule based on the user's department attribute, you can automate granting access to the SaaS application without manual intervention. This directly meets the requirement to automate access based on a user attribute.

Answer

Lifecycle workflows

Answer

Access reviews

Answer

Privileged identity management

Question 17

A company plans to implement a Zero Trust security model. Which of the following is the primary principle that should guide their strategy?

Accepted Answer

Assume breach and verify explicitly. The primary principle of Zero Trust is 'never trust, always verify,' which is operationalized as 'assume breach and verify explicitly.' This means every access request—regardless of source (internal or external)—must be authenticated, authorized, and encrypted before granting access. It eliminates implicit trust based on network location and enforces least-privilege access, which is foundational to the Zero Trust architecture.

Answer

Use a strong perimeter firewall as the primary defense

Answer

Grant trusted users full access to all resources

Answer

Trust but verify all internal traffic

Question 18

Refer to the exhibit. You are reviewing an ARM template that deploys a network security group (NSG) for a web application. The NSG allows inbound HTTP traffic from any source and then denies all other inbound traffic. However, after deployment, you find that HTTP traffic is being blocked. What is the most likely cause?

Accepted Answer

The NSG is not associated with the subnet or network interface where the web server is deployed.. Option B is correct because an NSG only filters traffic when it is associated with a subnet or a network interface card (NIC). Without association, the NSG rules are never applied, so the web server's HTTP traffic is not affected by the AllowHTTP rule and is instead subject to the default platform behavior, which allows all inbound traffic. Since the question states HTTP traffic is being blocked, the most likely cause is that the NSG is not associated with the subnet or NIC, leaving the web server's traffic ungoverned by the intended rules.

Answer

The AllowHTTP rule uses sourcePortRange '*' which conflicts with the DenyAll rule.

Answer

The DenyAll rule has a higher priority than the AllowHTTP rule, so it takes precedence.

Answer

The DenyAll rule uses protocol '*' which blocks all traffic including HTTP.

Question 19

Which TWO of the following are key components of a Zero Trust architecture according to Microsoft? (Choose two.)

Accepted Answer

Use least privilege access. In Microsoft's Zero Trust model, 'least privilege access' (Option C) is a core principle that ensures users and devices are granted only the minimum permissions necessary to perform their tasks, reducing the attack surface. This is enforced through technologies like Azure AD Conditional Access and Privileged Identity Management (PIM), which dynamically limit access based on risk and context.

Answer

Trust but verify

Answer

Implicit trust for internal traffic

Answer

Rely on a strong perimeter

Question 20

A security team is designing a Microsoft Sentinel deployment. They need to minimize costs while ensuring critical alerts are always processed. Which data retention and ingestion strategy should they use?

Accepted Answer

Use Basic Logs for high-volume low-value data and Analytics Logs for critical alerts. Option D is correct because it aligns with cost optimization and reliability requirements by using Basic Logs for high-volume, low-value data (e.g., firewall logs) and reserving Analytics Logs for critical alerts that require full query capabilities and interactive retention. This tiered approach ensures critical alerts are always processed with full fidelity while reducing storage costs for less important data.

Answer

Use Basic Logs for all data and retain for 90 days

Answer

Use Analytics Logs for all data and retain for 30 days

Answer

Use Basic Logs for critical alerts and retain for 30 days