SC-100 Practice Test 9 — 10 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure resources. The security team wants to prioritize remediation of high-severity findings based on the greatest potential business impact. Which security policy or framework should you configure to align remediation with business priorities?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the Regulatory Compliance dashboard. The Regulatory Compliance dashboard in Microsoft Defender for Cloud allows you to map security controls to specific regulatory standards (e.g., SOC 2, ISO 27001, PCI DSS) and track compliance posture. By selecting a framework that aligns with your organization's business obligations (e.g., a standard required by customers or regulators), you can prioritize remediation of high-severity findings based on the greatest potential business impact, such as fines or loss of certification.

Answer

Use the Azure Security Benchmark initiative

Answer

Set up workflow automation for high-severity findings

Answer

Configure the Secure Score dashboard

Question 2

Your organization uses Microsoft Defender XDR for detection and response. You need to create a custom detection rule that alerts when a user performs more than 10 failed sign-ins from different countries within 5 minutes. Which component should you use?

Accepted Answer

Custom detection rule in Microsoft 365 Defender. Custom detection rules in Microsoft 365 Defender allow you to define advanced hunting queries that trigger alerts based on specific event patterns, such as more than 10 failed sign-ins from different countries within 5 minutes. This is the correct component because it operates directly on data within the Defender XDR ecosystem (e.g., AADSignInEventsBeta) without requiring data ingestion into Sentinel.

Answer

Automation rule in Microsoft Sentinel

Answer

Analytics rule in Microsoft Sentinel

Answer

Attack simulation training

Question 3

Your organization is implementing Microsoft Entra ID Conditional Access. You need to require multi-factor authentication (MFA) for all users accessing financial applications, but only when the sign-in risk is medium or higher. What is the most efficient way to achieve this?

Accepted Answer

Create a Conditional Access policy that targets the financial applications, uses sign-in risk as a condition, and requires MFA. It uses a single Conditional Access policy to target the specific financial applications and sets the sign-in risk condition to medium or higher, which triggers MFA only when the risk threshold is met. This approach is efficient as it avoids per-user MFA configuration and leverages Microsoft Entra ID Protection's risk detection to dynamically enforce MFA based on real-time sign-in risk, aligning with the principle of adaptive access control.

Answer

Create a Microsoft Entra ID Protection user risk policy to require MFA

Answer

Enable MFA per user for all users in the financial team

Answer

Create a Conditional Access policy that targets all users, includes a named location, and requires MFA

Question 4

Your organization uses Microsoft Sentinel as a SIEM. The security team wants to use Microsoft Copilot for Security to assist in incident investigation. You need to ensure that Copilot can access Sentinel data while meeting compliance requirements. Which integration should you configure?

Accepted Answer

Enable Microsoft Copilot for Security plugin for Sentinel. The Microsoft Copilot for Security plugin for Sentinel is the correct integration because it enables Copilot to directly query and analyze Sentinel data through a native, compliant connection. This plugin uses Sentinel's API and role-based access control (RBAC) to ensure that Copilot only accesses data the user is authorized to see, meeting compliance requirements without additional data movement.

Answer

Deploy a playbook to query Sentinel data

Answer

Enable Sentinel's Threat Intelligence connectors

Answer

Use Microsoft Defender for Cloud

Question 5

A company uses Azure DevOps for CI/CD. The security team wants to ensure that secrets like API keys and connection strings are never stored in code repositories. Which best practice should they recommend?

Accepted Answer

Use Azure Key Vault references in Azure DevOps variable groups. Azure Key Vault references in Azure DevOps variable groups allow secrets to be securely linked to pipelines without ever storing them in code repositories. At pipeline runtime, the agent retrieves the secret value directly from Azure Key Vault using a managed identity or service principal, ensuring secrets are never exposed in YAML files, logs, or build artifacts.

Answer

Use environment variables in the pipeline YAML

Answer

Encrypt secrets using Git-secret and commit to repo

Answer

Store secrets in Azure App Configuration with encryption

Question 6

A company uses Microsoft Purview to manage data governance. They need to classify sensitive data automatically in Azure SQL Database. What should they configure?

Accepted Answer

Microsoft Purview Data Map scanning rules. Microsoft Purview Data Map scanning rules are the correct choice because they enable automated classification of sensitive data in Azure SQL Database by scanning the database schema and content against built-in or custom sensitive data types. This is the native mechanism within Purview to discover and label sensitive columns, such as credit card numbers or PII, directly in Azure SQL Database.

Answer

Microsoft Defender for Cloud regulatory compliance

Answer

Microsoft Sentinel data connectors

Answer

Microsoft Entra ID Protection

Question 7

A company uses Microsoft Entra ID Governance. They need to automate the process of granting access to a SaaS application based on the user's department attribute. Which feature should they use?

Accepted Answer

Entitlement management. Entitlement management in Microsoft Entra ID Governance allows you to create access packages that define collections of resources (like SaaS apps) and policies for who can request access. By configuring a dynamic membership rule based on the user's department attribute, you can automate granting access to the SaaS application without manual intervention. This directly meets the requirement to automate access based on a user attribute.

Answer

Lifecycle workflows

Answer

Access reviews

Answer

Privileged identity management

Question 8

Your organization is adopting Microsoft Entra ID as the identity provider for all SaaS applications. The security team wants to enforce multifactor authentication (MFA) for all users accessing these applications. Which approach aligns with security best practices and minimizes user friction?

Accepted Answer

Create a Conditional Access policy requiring MFA for all cloud apps, excluding trusted locations and devices.. Conditional Access policies allow granular, risk-based MFA enforcement that excludes trusted locations (e.g., corporate offices) and trusted devices (e.g., compliant or hybrid-joined devices). This aligns with the Zero Trust principle of 'verify explicitly' while minimizing user friction by not prompting for MFA when the user is already in a trusted context. Security defaults (Option C) enforce MFA for all users but lack the ability to exclude trusted locations or devices, which can cause unnecessary friction.

Answer

Enable per-user MFA for all users in Microsoft Entra ID.

Answer

Disable MFA and rely on strong password policies.

Answer

Enable Microsoft Entra ID Security defaults.

Question 9

A healthcare organization is using Microsoft Purview to govern its data estate. They have multiple Azure Data Lake Storage accounts and Azure SQL Databases. They need to classify sensitive data such as patient health information (PHI) and apply protection automatically when data is exported from these sources to an external location. The organization also wants to prevent unauthorized users from accessing sensitive data in Azure SQL Database by using built-in security features. The compliance team requires that any access to sensitive data be logged and auditable. You need to design a solution that meets these requirements. What should you implement?

Accepted Answer

Use Microsoft Purview to scan and classify data. Auto-apply sensitivity labels. Implement Azure AD authentication and row-level security in Azure SQL Database. Enable auditing and send to Log Analytics.. Microsoft Purview can scan data sources like Azure Data Lake Storage and Azure SQL Database, classify sensitive data such as PHI, and auto-apply sensitivity labels. Azure SQL Database supports Azure AD authentication and row-level security (RLS) to restrict access to sensitive data based on user identity. Auditing logs can be sent to Log Analytics for compliance. Option B is incorrect because it requires manual labeling and does not use row-level security. Option C uses Defender for Cloud (not Purview) and Always Encrypted (which does not prevent access to authorized users). Option D uses data masking (obfuscation) rather than access control and lacks auto-labeling and auditing integration.

Answer

Use Microsoft Purview to scan and classify data. Apply sensitivity labels manually. Configure Azure SQL Database firewall to block all but admin. Use Azure SQL auditing.

Answer

Use Microsoft Defender for Cloud to identify sensitive data. Implement Azure SQL Database always encrypted. Use Azure Monitor to log queries.

Answer

Use Microsoft Purview to classify data. Apply data masking in Azure SQL Database for PHI columns. Use Azure SQL Database threat detection.

Question 10

You are designing a security solution for a hybrid identity environment that uses Microsoft Entra ID and on-premises Active Directory. The company wants to enforce Zero Trust principles by continuously verifying user access. Which feature should you implement?

Accepted Answer

Implement Conditional Access policies that evaluate session risk in real time using continuous access evaluation. Continuous access evaluation (CAE) is the correct feature because it enforces Zero Trust by evaluating access decisions in real time when critical events occur (e.g., user risk changes, device compliance loss, or token revocation), rather than relying on token lifetime. This ensures that session risk is continuously verified, aligning with the Zero Trust principle of 'never trust, always verify'.

Answer

Implement Microsoft Entra Hybrid Join for all devices

Answer

Implement Microsoft Entra Seamless Single Sign-On

Answer

Implement Microsoft Entra ID Protection to require multi-factor authentication for all users