SC-100 Practice Exam 61 — 20 Questions

Question 1

A company is implementing a zero-trust security model. They need to enforce conditional access policies that require device compliance from Microsoft Intune. However, some users report being blocked when using personal devices that are not enrolled. What is the best approach to allow access while maintaining security?

Accepted Answer

Require app protection policies via Microsoft Intune. Option B is correct because Microsoft Intune app protection policies (APP) can enforce data protection and access controls on personal devices without requiring full enrollment. This allows the company to maintain a zero-trust posture by applying conditional access policies that check for app-level compliance, such as requiring a managed browser or blocking copy/paste, while still permitting access from unenrolled personal devices. This approach aligns with the zero-trust principle of 'never trust, always verify' by verifying device health at the application layer rather than the device layer.

Answer

Allow all devices but monitor with Defender for Cloud Apps

Answer

Block all non-compliant devices

Answer

Require device enrollment for all devices

Question 2

A company uses Microsoft Purview to classify and label sensitive data. They want to automatically apply a sensitivity label to documents containing a specific custom sensitive information type. Which TWO components are required for this?

Accepted Answer

Custom sensitive information type. Option C is correct because a custom sensitive information type defines the specific data pattern (e.g., a proprietary employee ID format) that Microsoft Purview can detect in documents. Option D is correct because an auto-labeling policy uses that custom sensitive information type as a condition to automatically apply a sensitivity label to matching content, without requiring user intervention.

Answer

Data loss prevention (DLP) policy

Answer

Retention label

Answer

Trainable classifier

Question 3

Your organization needs to comply with regulatory requirements for data retention and deletion. Which TWO Microsoft Purview features should you use?

Accepted Answer

Retention policies. Retention policies (A) are the correct choice because they allow you to define automated rules for retaining or deleting data at the container level (e.g., entire SharePoint sites, Exchange mailboxes, or OneDrive accounts) to meet regulatory requirements. Retention labels (D) are also correct because they provide granular, item-level control (e.g., specific documents or emails) for retention and deletion, and can be applied manually or automatically via trainable classifiers or sensitive information types. Together, they form the core of Microsoft Purview's data lifecycle management, ensuring compliance with data retention and deletion mandates.

Answer

Data Loss Prevention (DLP) policies

Answer

Audit logs

Answer

eDiscovery

Question 4

Your company uses Microsoft Purview to protect sensitive data. You need to automatically apply a retention label to documents containing credit card numbers detected in SharePoint Online. What should you configure?

Accepted Answer

Create an auto-labeling policy for retention labels targeting sensitive info types.. Option D is correct because auto-labeling policies in Microsoft Purview can automatically apply retention labels to documents based on sensitive info types, such as credit card numbers. This allows you to enforce retention rules without manual intervention, directly targeting the detected sensitive data in SharePoint Online.

Answer

Configure a Data Loss Prevention (DLP) policy to apply the label.

Answer

Create a sensitivity label with auto-labeling for SharePoint.

Answer

Use a trainable classifier to detect credit card numbers and apply the label.

Question 5

Your organization wants to enforce that all users authenticate using Microsoft Authenticator app for Microsoft Entra ID. Which authentication method should you configure as the primary?

Accepted Answer

Microsoft Authenticator passwordless phone sign-in. The question requires that all users authenticate using the Microsoft Authenticator app. The Microsoft Authenticator passwordless phone sign-in (option C) is the only method that both uses the Microsoft Authenticator app and provides a passwordless primary authentication experience. This method leverages FIDO2-based key attestation within the app, allowing users to sign in with a biometric or PIN gesture without entering a password.

Answer

FIDO2 security keys

Answer

Email one-time passcode

Answer

SMS-based verification

Question 6

You are a security architect for a software development company. The company uses GitHub for source control and Azure DevOps for CI/CD. They have a large number of repositories and want to ensure that secrets (e.g., API keys, connection strings) are never committed to code. They also want to scan pull requests for secrets before merging. The company has Microsoft Defender for Cloud and Microsoft Purview available. You need to design a solution that prevents secret leaks. What should you use?

Accepted Answer

Enable GitHub secret scanning for all repositories. Configure push protection to block commits containing secrets. Use custom patterns to scan for company-specific secrets.. Option A is correct because GitHub secret scanning is built into GitHub and can scan for known secret patterns; it can also be extended with custom patterns. It can block pushes that contain secrets. Option B is wrong because Azure Key Vault is a storage for secrets, not a scanning tool. Option C is wrong because Defender for Cloud does not scan GitHub repositories for secrets. Option D is wrong because Microsoft Purview Information Protection is for data classification, not secret scanning in code.

Answer

Enable Microsoft Defender for Cloud's 'Secrets scanning' feature for GitHub repositories.

Answer

Use Azure Key Vault to store secrets and enforce policies that require developers to use Key Vault references.

Answer

Use Microsoft Purview Information Protection to scan repositories and classify secrets.

Question 7

Your company is deploying a critical application on Azure App Service. You need to secure the application by restricting access to only users within your organization. The application should be accessible from both corporate-managed devices and personal devices that are enrolled in Microsoft Intune. You want to use Microsoft Entra ID for authentication and require that users authenticate using multi-factor authentication (MFA). What should you configure?

Accepted Answer

Configure a Conditional Access policy in Microsoft Entra ID that targets the application, requires MFA, and requires a compliant device.. Option A is correct because a Conditional Access policy can require MFA and compliant devices (via Intune) for access to the App Service app. Option B is wrong because App Service authentication alone does not enforce device compliance. Option C is wrong because an app registration alone does not enforce MFA. Option D is wrong because Azure AD B2B is for external users, not internal.

Answer

Use Azure AD B2B collaboration to allow only users from your organization.

Answer

Enable App Service authentication and authorization with Microsoft Entra ID as the identity provider.

Answer

Create an app registration in Microsoft Entra ID and assign users to the enterprise application.

Question 8

Your organization is deploying Azure SQL Managed Instance (SQL MI) with sensitive financial data. You need to design a security solution that includes data encryption at rest and in transit, threat detection, and fine-grained access control. The solution must also ensure that database administrators (DBAs) cannot access the data. What should you include?

Accepted Answer

Enable TDE and Always Encrypted for sensitive columns. Use Azure AD authentication. Enable Microsoft Defender for Cloud (SQL) for threat detection. Use Azure Policy to deny DBA access.. Option D uses TDE for at-rest encryption, Always Encrypted for column-level encryption, Defender for Cloud for threat detection, and Azure AD authentication to prevent DBA access. Option A lacks Always Encrypted; Option B lacks column encryption; Option C uses client-side encryption incorrectly.

Answer

Enable TDE and use server-level firewall rules. Use SQL authentication. Enable auditing.

Answer

Use client-side encryption with Always Encrypted. Use SQL authentication. Enable Advanced Threat Protection.

Answer

Enable TDE and use row-level security (RLS). Use Azure AD authentication. Enable Defender for SQL.

Question 9

Your company is designing a secure DevOps pipeline using Azure DevOps. You need to ensure that secrets (e.g., API keys) are stored securely and scanned for leaks in code repositories. The solution must integrate with Azure Policy to prevent deployment if secrets are exposed. You also need to enforce that only approved branches can deploy to production. What should you implement?

Accepted Answer

Store secrets in Azure Key Vault with a service connection. Use GitHub Advanced Security (secret scanning) integrated with Azure DevOps. Use branch policies to require pull requests for production.. Option A uses Key Vault for secrets, GitLeaks for scanning, and branch policies for control. Option B uses GitHub only; Option C lacks scanning; Option D uses wrong scanning tool.

Answer

Store secrets in a file in a private Git repo. Use a custom script to scan for secrets. Use Azure Policy to enforce branch policy.

Answer

Use variable groups in Azure DevOps to store secrets. Use Azure Policy to block deployments if secrets are in code. Use release gates.

Answer

Use Azure Key Vault with managed identities. Use Defender for Cloud to scan for secrets in repos. Use branch policies.

Question 10

You are a security architect at a global manufacturing company. The company uses a hybrid infrastructure with on-premises Active Directory and Azure. They have recently deployed Microsoft Sentinel as their SIEM. The security team wants to detect and investigate ransomware attacks that spread via SMB. The CISO has requested a solution that can automatically block malicious IPs at the network level and provide forensic evidence. You need to design a solution that meets these requirements with minimal manual intervention. What should you include in your design?

Accepted Answer

Integrate Microsoft Defender for Identity with Sentinel. Create a playbook that automatically adds malicious IPs to a custom Azure Firewall policy, and use Sentinel incidents for investigation.. Option C uses Microsoft Defender for Identity to detect SMB-based attacks and Azure Firewall to block IPs via playbooks. Option A uses Azure Firewall alone without detection; Option B uses NSG but cannot block based on real-time threat intel; Option D uses VPC (AWS) which is not applicable.

Answer

Deploy Azure Firewall with threat intelligence-based filtering enabled. Use Sentinel to generate alerts when SMB traffic is detected, and manually block IPs.

Answer

Use Microsoft Defender for Cloud to detect ransomware and deploy a third-party firewall in VPC. Configure Sentinel to send alerts to the firewall API.

Answer

Enable network security groups (NSGs) on all subnets. Use Sentinel to detect SMB anomalies and apply NSG rules via Azure Policy.

Question 11

Your company uses Microsoft 365 Defender (XDR) for endpoint detection and response. You need to design a solution to automatically remediate malware infections on Windows 10 devices. The solution should isolate the device from the network, run a full antivirus scan, and reset the device if the infection cannot be cleaned. What should you configure?

Accepted Answer

Enable automated investigation and remediation in Microsoft Defender for Endpoint with action settings: isolate, run AV, and reset.. Option C uses automated investigation and remediation in Defender for Endpoint. Option A is manual; Option B uses Intune for compliance, not remediation; Option D uses third-party tool.

Answer

Create a manual incident response process where analysts remotely connect and run scripts.

Answer

Deploy a third-party EDR tool that integrates with Microsoft Sentinel.

Answer

Configure Intune compliance policies to mark infected devices as non-compliant and require user action.

Question 12

You are designing a security solution for a financial services company that uses Microsoft 365 E5 and Azure. They have 10,000 users and 500 servers. They need to implement a Zero Trust network strategy that includes microsegmentation, identity-based access, and continuous monitoring. The solution must work across on-premises and cloud workloads. They also require that all access to critical servers is logged and audited. What should you include in your design?

Accepted Answer

Use Azure Virtual Network Manager (AVNM) for network groups and security admin rules. Implement Microsoft Entra ID Conditional Access with device compliance. Use Microsoft Defender for Cloud for continuous monitoring and Azure Policy for audit.. Option B uses Azure Network Manager for microsegmentation, Microsoft Entra ID for identity, and Defender for Cloud for monitoring. Option A uses Azure Firewall for perimeter only; Option C uses AWS; Option D uses VPN (not Zero Trust).

Answer

Deploy Azure Firewall Premium to segment the network. Use Microsoft Entra ID for identity. Use Azure Monitor for logging.

Answer

Use site-to-site VPN to connect all on-premises servers to Azure. Place all servers in a single VNet. Use NSGs for segmentation and Azure AD for identity.

Answer

Deploy a third-party SDN solution in AWS for microsegmentation. Use Microsoft Entra ID for identity. Use CloudWatch for logging.

Question 13

Your organization is implementing a privileged access workstation (PAW) strategy for administrators managing Azure resources. The PAWs are Windows 11 devices enrolled in Intune. You need to ensure that only approved applications can run on PAWs, and that device users cannot disable security features. The solution must also enforce that PAWs are used exclusively for administrative tasks. What should you configure?

Accepted Answer

Configure Windows Defender Application Control (WDAC) and AppLocker policies in Intune to allow only approved administrative tools. Use Intune compliance policies to block non-compliant devices. Use Azure AD Conditional Access to require PAW as compliant.. Option A uses Windows Defender Application Control (WDAC) and AppLocker to restrict apps, and Intune to enforce settings. Option B uses conditional access but not app control; Option C uses Azure AD roles but not device control; Option D is for guest access.

Answer

Enable Azure AD B2B collaboration for external admins. Use Intune to enforce device encryption.

Answer

Assign privileged roles using Azure AD Privileged Identity Management (PIM). Use Azure Policy to audit admin actions.

Answer

Use Azure AD Conditional Access to require multi-factor authentication and device compliance. Use Microsoft Defender for Cloud to monitor for admin activities.

Question 14

A startup, Alpine Ski House, is developing a mobile app that allows users to book ski lessons. The app communicates with an Azure Function App backend via REST APIs. The function app stores data in Azure Cosmos DB. The company wants to secure the API endpoints using OAuth 2.0 with Microsoft Entra ID and ensure that only authenticated users can invoke the functions. The function app should also use a managed identity to access Cosmos DB. Which of the following configurations should you implement?

Accepted Answer

Configure the function app to require authentication with Microsoft Entra ID, enforce HTTPS only, and use a system-assigned managed identity to access Cosmos DB.. Option A is correct because it uses OAuth 2.0 with Entra ID for authentication, managed identity for database access, and enforces HTTPS. Option B is wrong because function keys are not secure for user authentication. Option C is wrong because client certificates do not provide user-level authentication. Option D is wrong because IP whitelisting is not a substitute for authentication.

Answer

Configure the function app to use function-level authorization keys, enforce HTTPS only, and use a connection string with a read-write key to access Cosmos DB.

Answer

Configure the function app to require client certificates, enforce HTTPS only, and use a managed identity to access Cosmos DB.

Answer

Configure the function app to use IP whitelisting, enforce HTTPS only, and use a managed identity to access Cosmos DB.

Question 15

Trey Research, a biotech firm, is developing a machine learning model on Azure Machine Learning that uses sensitive genomic data. The data is stored in Azure Blob Storage. The company requires that all data be encrypted at rest using customer-managed keys stored in Azure Key Vault, and that access to the storage account be restricted to the Azure Machine Learning workspace and specific data scientists via Azure AD authentication. Additionally, the storage account must be accessible only from the company's virtual network. Which of the following configurations should you implement?

Accepted Answer

Enable encryption at rest with a customer-managed key, configure a private endpoint for the storage account, and grant the Machine Learning workspace and data scientists access using Azure RBAC with the Storage Blob Data Contributor role.. Option B is correct because it provides encryption at rest with CMK, private endpoint for VNet isolation, and RBAC for access control. Option A is wrong because firewall rules are less secure than private endpoints. Option C is wrong because SAS tokens are less secure than managed identities. Option D is wrong because service-managed keys do not meet the CMK requirement.

Answer

Enable encryption at rest with a customer-managed key, configure a firewall to allow the Machine Learning workspace's IP range, and grant data scientists access via storage account access keys.

Answer

Enable encryption at rest with a service-managed key, configure a private endpoint, and grant data scientists access using Azure RBAC with the Storage Blob Data Reader role.

Answer

Enable encryption at rest with a customer-managed key, configure a service endpoint for the storage account, and grant the Machine Learning workspace access using a SAS token.

Question 16

You are designing a solution to protect sensitive data in Azure Blob Storage. The data must be encrypted at rest using customer-managed keys (CMK) stored in Azure Key Vault. Additionally, you need to ensure that only specific virtual networks can access the storage account, and all access must be logged. Which three configurations should you implement? (Choose three.)

Accepted Answer

Enable Azure Storage logging for read and write requests. Options A, C, and D are correct. Option A provides CMK encryption. Option C restricts network access. Option D enables logging. Option B is wrong: Azure Files is different; Blob Storage encryption is configured at the account level. Option E is wrong: Soft delete is for data recovery, not encryption or access control.

Answer

Enable Azure Files encryption at rest

Answer

Enable soft delete for blobs

Question 17

You are designing a secure access solution for an Azure App Service web application that authenticates users via Microsoft Entra ID. The requirements include: only allowing users from a specific Entra ID tenant, and blocking access from certain countries. Which two features should you combine? (Choose two.)

Accepted Answer

App Service authentication with Microsoft Entra ID. Options A and D are correct: App Service authentication restricts to a specific tenant, and geo-filtering on Azure Front Door blocks countries. Option B is wrong because NSGs filter network traffic, not user authentication. Option C is wrong because Conditional Access can apply policies but not geo-blocking at the network edge. Option E is wrong because Managed Identity is for app-to-Azure authentication, not user access.

Answer

Network Security Groups (NSGs)

Answer

Microsoft Entra Conditional Access

Answer

Managed Identity

Question 18

You are a security architect for a large enterprise that is migrating to Microsoft 365. The organization has 50,000 users across multiple regions. They have recently experienced a ransomware attack that encrypted files on SharePoint Online and OneDrive for Business. The security team wants to implement a comprehensive protection strategy. Requirements: 1. Automatically detect and block ransomware-like behavior in real-time. 2. Provide users with self-service recovery of files encrypted by ransomware. 3. Ensure that all files in SharePoint and OneDrive are scanned for malware upon upload. 4. Minimize administrative overhead. Which combination of Microsoft 365 security features should you recommend?

Accepted Answer

Enable Microsoft Defender for Office 365 to scan files on upload and use version history and recycle bin for recovery.. Option C is correct because Microsoft Defender for Office 365 provides real-time scanning of files uploaded to SharePoint and OneDrive, detecting and blocking known malware. Combined with version history and the recycle bin, users can self-recover files encrypted by ransomware without administrative intervention, satisfying all requirements with minimal overhead.

Answer

Use Microsoft Entra ID Protection to detect compromised accounts and automatically block access.

Answer

Enable Microsoft Endpoint DLP and configure file policies to block encrypted files.

Answer

Configure Microsoft Purview auto-labeling to apply a 'Ransomware' label and then block all labeled files.

Question 19

Fabrikam is a healthcare organization that uses Microsoft 365 E5 and Azure. They have a hybrid identity environment with Active Directory on-premises synced to Microsoft Entra ID. The security team wants to implement a Zero Trust strategy following the 'verify explicitly' principle. They need to ensure that all access to Microsoft 365 services and Azure applications is conditionally enforced based on real-time risk signals. Additionally, they want to block legacy authentication protocols that do not support modern authentication. The solution must integrate with Microsoft Defender XDR and Microsoft Sentinel for threat intelligence. Which combination of technologies should you recommend?

Accepted Answer

Use Microsoft Entra Conditional Access policies with session controls from Microsoft Defender for Cloud Apps. Enable Microsoft Entra ID Protection to feed risk signals into Conditional Access. Block legacy authentication via a Conditional Access policy targeting 'Exchange Active Sync' and 'Other clients'. Integrate Microsoft Sentinel to ingest alerts from Defender XDR.. Option D is correct because it directly implements the 'verify explicitly' principle by using Microsoft Entra ID Protection to feed real-time risk signals into Conditional Access policies, which then enforce session controls via Microsoft Defender for Cloud Apps. It blocks legacy authentication through a targeted Conditional Access policy (not just disabling protocols in Exchange Online or at the firewall), and integrates Microsoft Sentinel to ingest alerts from Defender XDR for centralized threat intelligence. This combination ensures all access to Microsoft 365 and Azure applications is conditionally enforced based on dynamic risk, while also addressing the requirement to block legacy protocols that lack modern authentication support.

Answer

Implement Azure AD Identity Governance with access reviews. Use Conditional Access to require hybrid Azure AD joined devices. Block legacy authentication by disabling protocols in Exchange Online. Use Azure Sentinel without Defender XDR.

Answer

Use Azure AD B2B for external users only. Configure Conditional Access with MFA for all users. Use Azure AD Identity Protection for risk. Block legacy authentication at the firewall level.

Answer

Deploy Microsoft Intune for mobile device management and require compliant devices. Use Conditional Access to block legacy protocols. Rely on Azure ATP (now Microsoft Defender for Identity) for risk signals.

Question 20

Proseware, a pharmaceutical company, is deploying a new AI-powered application using Azure OpenAI Service. The application will process sensitive research data and must comply with HIPAA. The security team wants to ensure that the data sent to the Azure OpenAI endpoint is not logged or stored by Microsoft, and that access to the service is restricted to authorized users with appropriate data classification. They also need to monitor for potential data exfiltration and prompt injection attacks. What should you recommend?

Accepted Answer

Provision Azure OpenAI Service with a 'data processing addendum' (DPA) to ensure no data is stored or logged. Configure Content Filtering to block sensitive data. Use Microsoft Purview Data Classification to label research data. Use Microsoft Defender for Cloud Apps (part of Defender XDR) to create a session policy that monitors and blocks data exfiltration attempts. Enable audit logging to Microsoft Sentinel for anomaly detection.. Option D is correct because it combines a Data Processing Addendum (DPA) to contractually prevent Microsoft from logging or storing data, Microsoft Purview Data Classification for labeling sensitive research data, and Microsoft Defender for Cloud Apps session policies to monitor and block data exfiltration. Additionally, enabling audit logging to Microsoft Sentinel provides anomaly detection for prompt injection attacks, fulfilling all HIPAA compliance and security requirements.

Answer

Use Azure OpenAI Service with default settings. Implement Microsoft Sentinel to detect threats. Use Azure Policy to enforce tagging of resources. Use Azure AD Conditional Access to require MFA for access.

Answer

Use Azure OpenAI Service with a private endpoint. Deploy Azure Information Protection to classify data. Use Azure Firewall to restrict access. Implement Azure DDoS Protection.

Answer

Use Azure OpenAI Service with managed identity. Configure Conditional Access to restrict access by IP. Use Azure Monitor to track usage. Implement Azure Key Vault for API keys.