SC-100 Practice Exam 58 — 20 Questions

Question 1

You are designing a secure DevOps pipeline in GitHub that deploys to Azure Kubernetes Service (AKS). The security team requires that no secrets are stored in the pipeline variables and that all container images are scanned for vulnerabilities before deployment. Which approach aligns with security best practices?

Accepted Answer

Use GitHub Actions with OpenID Connect to authenticate to Azure without storing any secrets. Integrate Microsoft Defender for Containers to scan images in Azure Container Registry.. Option B is correct because it uses OpenID Connect (OIDC) to authenticate GitHub Actions to Azure without storing any long-lived secrets, which aligns with the requirement that no secrets be stored in pipeline variables. Additionally, integrating Microsoft Defender for Containers provides vulnerability scanning for container images in Azure Container Registry (ACR), meeting the image scanning requirement before deployment to AKS.

Answer

Use Azure DevOps with a service principal that has a client secret stored in Azure Key Vault. Use Trivy to scan images.

Answer

Use GitHub Actions with a managed identity for the GitHub runner. Disable image scanning to speed up deployments.

Answer

Use GitHub Actions with environment secrets for Azure service principal credentials. Use Docker Hub's vulnerability scanning.

Question 2

A company uses Microsoft Defender for Cloud to assess the security posture of their Azure subscriptions. They want to ensure that all virtual machines have the Log Analytics agent installed and that missing system updates are remediated automatically. Which two recommendations should be enabled in a single policy initiative?

Accepted Answer

Enable the Microsoft Defender for Cloud 'System Updates' and 'Log Analytics agent' recommendations via a built-in initiative.. Option D is correct because Microsoft Defender for Cloud includes a built-in policy initiative (the 'ASC Default' initiative) that contains both the 'System Updates' and 'Log Analytics agent' recommendations. Enabling this single initiative automatically assigns both requirements to the selected scope, ensuring that missing system updates are remediated and the Log Analytics agent is installed on all virtual machines without needing custom policies or separate assignments.

Answer

Assign two separate Azure Policy initiatives, one for each requirement.

Answer

Create a custom Azure Policy initiative that combines the two requirements.

Answer

Use Azure Blueprints to assign the policies to all subscriptions.

Question 3

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. You need to design a policy that prevents users from sharing credit card numbers via email. Which THREE components are required to build this DLP policy?

Accepted Answer

A rule that includes a sensitive info type for credit card numbers. Option B is correct because a DLP policy must include a rule that defines the sensitive data to detect. For credit card numbers, Microsoft Purview provides a built-in sensitive info type (SIT) that uses pattern matching, checksum validation, and keyword proximity to accurately identify credit card numbers. Without this rule, the policy would have no criteria to trigger actions.

Answer

A policy tip to warn users before sending

Answer

A trainable classifier for financial data

Question 4

Which THREE are components of Microsoft's Zero Trust model?

Accepted Answer

Data. Option A is correct because data is one of the six foundational pillars of Microsoft's Zero Trust model (identities, endpoints, data, apps, infrastructure, and network). The Zero Trust model explicitly treats data as a critical asset that must be protected regardless of location, using encryption, labeling, and Data Loss Prevention (DLP) policies to enforce least-privilege access and continuous validation.

Answer

Assume breach

Answer

Microsoft Defender for Cloud

Question 5

A company is designing a security strategy for their AI-powered applications using Microsoft Azure OpenAI Service. They need to ensure that the AI models are not used to generate harmful content and that the data sent to the models is protected. Which Microsoft Purview feature should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) for AI. Microsoft Purview Data Loss Prevention (DLP) for AI is the correct feature because it is specifically designed to monitor and control the data sent to and from AI applications, including Azure OpenAI Service, to prevent the generation of harmful content and protect sensitive data. It uses deep content analysis and policy-based controls to detect and block policy violations in real-time, directly addressing the dual requirements of content safety and data protection.

Answer

Microsoft Purview Endpoint DLP

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Audit

Question 6

A company is implementing Microsoft Defender for Cloud to protect their Azure environment. Which TWO of the following are security best practices that should be enabled? (Choose two.)

Accepted Answer

Cloud Security Posture Management (CSPM). Cloud Security Posture Management (CSPM) is a core feature of Microsoft Defender for Cloud that continuously assesses your Azure environment against security benchmarks (e.g., Azure Security Benchmark) and provides actionable recommendations to harden configurations. Enabling CSPM is a foundational best practice because it proactively identifies misconfigurations (like open management ports or unencrypted storage) before they can be exploited, directly aligning with the 'prevent' phase of the shared responsibility model.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Endpoint onboarding

Answer

Microsoft Sentinel integration

Question 7

You are designing a security operations strategy for Microsoft 365. You need to prioritize alerts from Microsoft Defender XDR based on their impact on business operations. Which security best practice should you follow?

Accepted Answer

Prioritize alerts based on a risk assessment that considers asset criticality, threat severity, and business impact. Option A is correct because Microsoft Defender XDR integrates with Microsoft 365 Defender's risk-based alert prioritization, which uses a combination of asset criticality (e.g., from Microsoft Purview or Defender for Cloud Apps), threat severity (e.g., from the Microsoft Defender portal's alert severity levels: Informational, Low, Medium, High), and business impact (e.g., via sensitivity labels or data classification). This aligns with the security best practice of risk-based alert triage, ensuring that high-impact alerts are addressed first to minimize business disruption.

Answer

Prioritize alerts based on a qualitative risk assessment only

Answer

Treat all alerts with equal severity to ensure none are missed

Answer

Prioritize alerts based solely on the MITRE ATT&CK technique involved

Question 8

You are designing a solution to protect Microsoft 365 data from insider threats. Which TWO Microsoft Purview features should you use?

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management is correct because it is specifically designed to detect, investigate, and act on malicious and accidental insider risks by correlating signals from Microsoft 365 and Azure services, such as unusual file downloads or data exfiltration patterns. It uses predefined risk indicators and machine learning models to identify risky user activities that could lead to data breaches, making it a primary tool for protecting data from insider threats.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Audit (Premium)

Answer

Microsoft Purview eDiscovery (Premium)

Question 9

A company is designing a data security strategy using Microsoft Purview. They need to identify sensitive data across their data estate, including on-premises SQL Server, Azure SQL Database, and Amazon S3. Which THREE components should they use? (Choose three.)

Accepted Answer

Microsoft Purview Data Estate Insights. Microsoft Purview Data Estate Insights provides visibility into data estate health and security posture, including sensitive data discovery across on-premises SQL Server, Azure SQL Database, and Amazon S3. It aggregates scan results and offers dashboards to identify where sensitive data resides, enabling targeted classification and protection actions.

Answer

Microsoft Purview External Identities

Answer

Microsoft Purview Compliance Manager

Question 10

Your organization is designing a security strategy for Microsoft 365. You need to align with Microsoft's Zero Trust best practices. Which TWO principles should be included?

Accepted Answer

Verify explicitly. The Zero Trust model, as defined by Microsoft, is built on three foundational principles: verify explicitly, use least privilege, and assume breach. 'Verify explicitly' means always authenticating and authorizing based on all available data points, including user identity, location, device health, service or workload, data classification, and anomalies, before granting access. This aligns directly with Microsoft's implementation in Azure AD Conditional Access, which enforces real-time policy evaluation for every access request.

Answer

Trust but verify

Answer

Verify implicitly

Answer

Use least privilege

Question 11

A company plans to use Microsoft Purview to manage data governance across their on-premises SQL Server databases and Azure SQL databases. They need to classify sensitive data and create a unified data map. Which resource should they deploy?

Accepted Answer

Microsoft Purview. Microsoft Purview is the correct choice because it provides a unified data governance service that can scan both on-premises SQL Server and Azure SQL databases, automatically classify sensitive data using built-in classifiers (e.g., PII, financial info), and build a centralized data map. This aligns with the requirement to manage data governance across hybrid environments with a single pane of glass.

Answer

Azure Synapse Analytics

Answer

Azure Data Factory

Answer

Azure SQL Database

Question 12

A company uses Microsoft Defender for Endpoint to protect endpoints. They want to configure attack surface reduction rules to block executable files from running unless they meet a specific prevalence, age, or trust level. Which ASR rule should they enable?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criteria. Option D is correct because the ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criteria' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) is specifically designed to block executables that do not meet Microsoft's cloud-based prevalence, age, or trustworthiness criteria. This rule uses the Microsoft Intelligent Security Graph to evaluate files against global telemetry, blocking those that are new, rare, or unsigned, which directly matches the requirement to block executables based on prevalence, age, or trust level.

Answer

Block Office communication application from creating child processes

Answer

Block credential stealing from the Windows local security authority subsystem

Answer

Block untrusted and unsigned processes that run from USB

Question 13

Your organization uses Microsoft Sentinel and has deployed the Analytics rule 'TI map IP entity to AzureActivity' to detect suspicious activities based on threat intelligence. The SOC team reports that the rule has a high false positive rate because it matches benign IP addresses used by legitimate services. What design change should you recommend to reduce false positives while maintaining detection coverage?

Accepted Answer

Create a watchlist of trusted IP addresses and modify the rule to exclude those IPs.. Option C is correct because creating a watchlist of trusted IP addresses and modifying the TI map IP entity to AzureActivity rule to exclude those IPs directly addresses the high false positive rate caused by benign IPs. This approach preserves detection coverage for all other threat intelligence matches while filtering out known legitimate services, leveraging Sentinel's watchlist feature for dynamic exclusion without disabling the rule.

Answer

Increase the alert threshold to require multiple occurrences within a time window.

Answer

Disable the rule and rely on manual hunting queries.

Answer

Create a separate analytics rule that suppresses alerts when the source IP is in a trusted list.

Question 14

You are designing a Microsoft Purview data security solution for a multinational organization subject to GDPR and CCPA. Which THREE Purview capabilities should you include to meet regulatory requirements?

Accepted Answer

Data Loss Prevention (DLP) policies. Data Loss Prevention (DLP) policies are correct because they allow the organization to detect and prevent the accidental or intentional sharing of sensitive data—such as personally identifiable information (PII) covered under GDPR and CCPA—across email, SharePoint, OneDrive, and endpoints. By scanning content for sensitive information types (e.g., credit card numbers, EU passport numbers) and applying protective actions (e.g., blocking transmission, showing policy tips), DLP directly enforces data protection mandates required by these regulations.

Answer

Advanced eDiscovery

Answer

Data Lifecycle Management (retention policies)

Question 15

Your organization is adopting Microsoft Entra ID as the identity provider for all SaaS applications. The security team wants to enforce multifactor authentication (MFA) for all users accessing these applications. Which approach aligns with security best practices and minimizes user friction?

Accepted Answer

Create a Conditional Access policy requiring MFA for all cloud apps, excluding trusted locations and devices.. Option D is correct because Conditional Access policies allow granular, risk-based MFA enforcement that excludes trusted locations (e.g., corporate offices) and trusted devices (e.g., compliant or hybrid-joined devices). This aligns with the Zero Trust principle of 'verify explicitly' while minimizing user friction by not prompting for MFA when the user is already in a trusted context. Security defaults (Option C) enforce MFA for all users but lack the ability to exclude trusted locations or devices, which can cause unnecessary friction.

Answer

Enable per-user MFA for all users in Microsoft Entra ID.

Answer

Disable MFA and rely on strong password policies.

Answer

Enable Microsoft Entra ID Security defaults.

Question 16

Your organization uses Microsoft Sentinel and wants to automatically respond to high-severity incidents. Which feature should you configure?

Accepted Answer

Configure an automation rule to run a playbook automatically. Automation rules in Microsoft Sentinel allow you to define automated responses that trigger when an incident is created or updated, including running playbooks (Azure Logic Apps workflows) automatically. This is the correct approach for automatically responding to high-severity incidents because it eliminates manual intervention and ensures consistent, immediate action based on incident properties like severity.

Answer

Create a playbook and run it manually for each incident

Answer

Set up an analytics rule with automatic response

Answer

Use a workbook to trigger a playbook

Question 17

Your organization uses Microsoft Defender XDR for detection and response. You need to create a custom detection rule that alerts when a user performs more than 10 failed sign-ins from different countries within 5 minutes. Which component should you use?

Accepted Answer

Custom detection rule in Microsoft 365 Defender. Custom detection rules in Microsoft 365 Defender allow you to define advanced hunting queries that trigger alerts based on specific event patterns, such as more than 10 failed sign-ins from different countries within 5 minutes. This is the correct component because it operates directly on data within the Defender XDR ecosystem (e.g., AADSignInEventsBeta) without requiring data ingestion into Sentinel.

Answer

Automation rule in Microsoft Sentinel

Answer

Analytics rule in Microsoft Sentinel

Answer

Attack simulation training

Question 18

Your organization uses Microsoft Sentinel to aggregate logs from on-premises and cloud sources. You need to reduce the cost of data ingestion while ensuring security-critical logs are retained for at least one year. What should you do?

Accepted Answer

Ingress security-critical logs to the Analytics logs tier with 365-day retention, and other logs to the Auxiliary logs tier with shorter retention. Option B is correct because it leverages the Analytics logs tier for security-critical logs, which supports full KQL query capabilities and allows setting a 365-day retention period to meet compliance requirements. Other logs can be sent to the Auxiliary logs tier (formerly Basic logs), which offers lower ingestion costs and shorter retention, reducing overall data ingestion expenses while still retaining necessary logs for security analysis.

Answer

Archive all logs to Azure Storage after 90 days

Answer

Use the Basic logs tier for all logs and set retention to 365 days

Answer

Set the default retention to 30 days and export logs to Log Analytics Workspace

Question 19

A company plans to implement Microsoft Purview to enforce data loss prevention (DLP) policies. They need to prevent users from sharing credit card numbers via email. What should they configure?

Accepted Answer

Create a DLP policy that detects and blocks credit card numbers in Exchange Online. Option C is correct because Microsoft Purview Data Loss Prevention (DLP) policies can be configured to detect sensitive data types, such as credit card numbers, in Exchange Online emails. When a DLP policy is created with a rule that identifies credit card numbers and blocks the email from being sent, it directly prevents users from sharing that data via email. This is the native mechanism for enforcing DLP on email traffic in Microsoft 365.

Answer

Create a sensitivity label and apply it to emails

Answer

Enable communication compliance policies

Answer

Configure a retention policy for email

Question 20

Your organization uses Microsoft Entra ID and wants to implement a passwordless authentication strategy. Users have smartphones. Which method should you recommend as the primary authentication method?

Accepted Answer

Microsoft Authenticator app with passwordless sign-in. The Microsoft Authenticator app with passwordless sign-in is the correct primary method because it leverages the user's smartphone to provide a seamless, phishing-resistant authentication experience using public/private key cryptography (FIDO2/WebAuthn). This method aligns with the organization's goal of eliminating passwords while utilizing existing smartphone hardware, and it supports a simple user experience by requiring only a biometric or PIN verification on the phone.

Answer

FIDO2 security keys

Answer

SMS-based authentication

Answer

Windows Hello for Business