SC-100 Hard Questions — 25 Difficult Questions

Question 1

Your organization uses Microsoft Sentinel and wants to improve threat hunting efficiency. Which THREE actions should you take?

Accepted Answer

Enable UEBA (User and Entity Behavior Analytics). UEBA (User and Entity Behavior Analytics) in Microsoft Sentinel uses machine learning models to establish baseline behavioral patterns for users, hosts, and other entities. It then detects anomalous activities such as unusual logon times, impossible travel, or abnormal data exfiltration, which directly enhances threat hunting by surfacing suspicious behaviors that might otherwise go unnoticed.

Answer

Use watchlists to filter out known benign IPs

Answer

Reduce data retention period to improve query speed

Question 2

Your company is deploying a new AI-powered customer service chatbot using Azure OpenAI Service. The chatbot will access customer data stored in Azure Cosmos DB. The security team requires that all data in transit is encrypted, and that the chatbot only accesses data necessary for its function. Additionally, the chatbot must use managed identities to authenticate to Cosmos DB. You need to design the security architecture. Which combination of controls should you implement?

Accepted Answer

Enable TLS enforcement on Cosmos DB. Use a managed identity for the chatbot and assign the Cosmos DB Built-in Data Reader role. Configure the chatbot to authenticate using the managed identity.. It enforces TLS for data in transit, uses a managed identity for authentication, and assigns the Cosmos DB Built-in Data Reader role to implement least privilege access. Option A is incorrect because IP restrictions alone do not provide authentication and the Account Reader role does not allow data access. Option B is incorrect because using a connection string exposes secrets and the Contributor role grants excessive permissions. Option D is incorrect because it uses a service principal instead of a managed identity, which is a requirement.

Answer

Restrict network access to the chatbot's IP address. Use a system-assigned managed identity and assign the Cosmos DB Account Reader role.

Answer

Use a connection string with the Cosmos DB account key and enforce TLS 1.2. Grant the chatbot's managed identity contributor role.

Answer

Use Azure AD authentication with a service principal and assign the Cosmos DB Built-in Data Contributor role. Enforce TLS 1.2.

Question 3

A company needs to design a secure DevOps pipeline using GitHub Actions and Microsoft Defender for Cloud. They want to scan infrastructure-as-code (IaC) templates for misconfigurations before deployment. What should they integrate?

Accepted Answer

Microsoft Defender for Cloud Infrastructure as Code scanning. Microsoft Defender for Cloud includes a native Infrastructure as Code (IaC) scanning capability that integrates directly with GitHub Actions. This feature automatically analyzes IaC templates (such as ARM, Bicep, Terraform, and CloudFormation) for security misconfigurations during the CI/CD pipeline, providing pre-deployment guardrails. By failing the pipeline on critical findings, it ensures only compliant infrastructure is deployed, aligning with the secure DevOps principle of shifting security left.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 4

Your organization is migrating to Microsoft 365 and wants to implement a data classification strategy. The compliance team needs to automatically detect and label documents containing personal data (e.g., Social Security numbers) in SharePoint Online. Which Microsoft Purview solution should you use?

Accepted Answer

Auto-labeling policies. Auto-labeling policies in Microsoft Purview are designed to automatically detect sensitive data types (e.g., Social Security numbers) using built-in or custom sensitive information types and apply sensitivity labels to documents in SharePoint Online. This meets the requirement for automatic detection and labeling without user intervention, as the compliance team needs.

Answer

Records Management

Answer

eDiscovery

Answer

Data Loss Prevention policies

Question 5

Your company, Lucerne Publishing, is migrating its on-premises SQL Server databases to Azure SQL Managed Instance. The databases contain sensitive customer data subject to GDPR. You need to design a security solution that includes: (1) Always Encrypted for sensitive columns, (2) dynamic data masking for non-privileged users, (3) auditing of all data access, and (4) encryption at rest using customer-managed keys stored in Azure Key Vault. Which of the following configurations should you implement?

Accepted Answer

Enable Always Encrypted for sensitive columns, configure dynamic data masking, enable Azure SQL auditing to a Log Analytics workspace, and enable TDE with a customer-managed key stored in Azure Key Vault.. It includes all required features: Always Encrypted for column-level encryption, dynamic data masking, Azure SQL auditing to a Log Analytics workspace (which integrates with Azure Monitor for centralized auditing), and TDE using customer-managed keys (CMK) stored in Azure Key Vault to meet the encryption-at-rest requirement. Option A is incorrect because it mentions enabling auditing via Azure Policy, which is not the standard auditing method for Azure SQL Managed Instance; instead, Azure SQL auditing to Log Analytics is needed. Also, TDE with a customer-managed key must be explicitly configured. Option B is incorrect because disabling TDE would compromise encryption at rest, and row-level security is not required. Option C is incorrect because TDE with a service-managed key does not fulfill the customer-managed key requirement.

Answer

Enable Always Encrypted for sensitive columns, configure dynamic data masking, enable auditing via Azure Policy, and enable TDE with a customer-managed key stored in Azure Key Vault.

Answer

Enable Always Encrypted for sensitive columns, configure dynamic data masking, disable TDE to improve performance, and use row-level security to restrict access.

Answer

Enable Always Encrypted for sensitive columns, configure dynamic data masking, enable SQL Server auditing to Azure Blob Storage, and enable Transparent Data Encryption (TDE) with a service-managed key.

Question 6

Which THREE capabilities does Microsoft Purview provide for compliance management?

Accepted Answer

Information protection with sensitivity labels. Microsoft Purview provides compliance management capabilities including information protection with sensitivity labels, which allow organizations to classify and protect sensitive data across Microsoft 365 services, endpoints, and third-party apps. Sensitivity labels enforce encryption, visual markings, and access restrictions based on policy, directly supporting data loss prevention and governance.

Answer

Identity protection and risk detection

Answer

Endpoint detection and response

Question 7

You are designing a Microsoft Purview data security solution for a multinational organization subject to GDPR and CCPA. Which THREE Purview capabilities should you include to meet regulatory requirements?

Accepted Answer

Data Loss Prevention (DLP) policies. Data Loss Prevention (DLP) policies are correct because they allow the organization to detect and prevent the accidental or intentional sharing of sensitive data—such as personally identifiable information (PII) covered under GDPR and CCPA—across email, SharePoint, OneDrive, and endpoints. By scanning content for sensitive information types (e.g., credit card numbers, EU passport numbers) and applying protective actions (e.g., blocking transmission, showing policy tips), DLP directly enforces data protection mandates required by these regulations.

Answer

Advanced eDiscovery

Answer

Data Lifecycle Management (retention policies)

Question 8

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Sentinel. You need to create an analytics rule in Sentinel that triggers an incident when a device is reported as 'high risk' by MDE. Which data source and rule type should you use?

Accepted Answer

Microsoft Defender XDR connector with a Scheduled query rule. The Microsoft Defender XDR connector ingests alerts from Microsoft Defender for Endpoint (MDE) into Sentinel. A Scheduled query rule is required to run a KQL query at a defined interval (e.g., every 5 minutes) that checks for devices with a 'high risk' severity level in the ingested alert data. This combination allows you to create an incident when MDE reports a device as high risk.

Answer

Microsoft Sentinel's Anomalous Activity rule

Answer

Microsoft 365 Defender connector with an NRT query rule

Answer

Microsoft Defender for Cloud connector with a Fusion rule

Question 9

A security architect is designing a solution to protect sensitive data stored in SharePoint Online from being shared with unauthorized users. The solution must block sharing of files containing credit card numbers when shared externally. What should they use?

Accepted Answer

Create a Microsoft Purview sensitivity label that automatically applies encryption and blocks external sharing when credit card numbers are detected. Microsoft Purview sensitivity labels can be configured with automatic classification for sensitive data types (e.g., credit card numbers) and enforce encryption while blocking external sharing. This directly meets the requirement to prevent unauthorized external sharing of files containing credit card numbers in SharePoint Online.

Answer

Configure a conditional access policy to block access from untrusted networks when credit card numbers are detected

Answer

Create a Microsoft Purview Data Loss Prevention (DLP) policy that blocks external sharing when credit card numbers are detected

Answer

Use Azure Information Protection to label and protect files with credit card numbers

Question 10

Your organization has a multi-region Azure deployment with ExpressRoute connections to on-premises. You need to design a solution that ensures all traffic between on-premises and Azure is inspected by a firewall for both inbound and outbound connections. The solution must minimize latency and avoid a single point of failure. What design should you recommend?

Accepted Answer

Deploy Azure Firewall in each region with forced tunneling enabled. Deploying Azure Firewall in each region with forced tunneling ensures all traffic between on-premises and Azure is inspected by a firewall, minimizes latency because traffic is inspected locally, and avoids a single point of failure by using multiple firewalls. Option B is incorrect because a single central hub creates a single point of failure and adds latency. Option C is incorrect because NSGs filter traffic based on rules but do not provide stateful inspection. Option D is incorrect because a third-party NVA in a single hub introduces a single point of failure and higher latency.

Answer

Deploy Azure Firewall in one central hub region and route all traffic through it

Answer

Use Network Security Groups (NSGs) on subnets to filter traffic

Answer

Deploy a third-party NVA in a hub-and-spoke topology with a single hub

Question 11

A company uses Microsoft Intune to manage devices. They need to ensure that only compliant devices can access corporate email. They plan to use Conditional Access in Microsoft Entra ID. Which THREE components must be configured?

Accepted Answer

Device registration in Entra ID. Device registration in Entra ID (A) is required because Conditional Access policies evaluate device compliance based on the device's identity in Entra ID. Without registration, the device lacks a unique identity that Entra ID can assess for compliance status, making it impossible to enforce access controls based on device state.

Answer

Windows Autopilot deployment profile

Answer

Configuration profile in Intune

Question 12

Proseware, a pharmaceutical company, is deploying a new AI-powered application using Azure OpenAI Service. The application will process sensitive research data and must comply with HIPAA. The security team wants to ensure that the data sent to the Azure OpenAI endpoint is not logged or stored by Microsoft, and that access to the service is restricted to authorized users with appropriate data classification. They also need to monitor for potential data exfiltration and prompt injection attacks. What should you recommend?

Accepted Answer

Provision Azure OpenAI Service with a 'data processing addendum' (DPA) to ensure no data is stored or logged. Configure Content Filtering to block sensitive data. Use Microsoft Purview Data Classification to label research data. Use Microsoft Defender for Cloud Apps (part of Defender XDR) to create a session policy that monitors and blocks data exfiltration attempts. Enable audit logging to Microsoft Sentinel for anomaly detection.. To meet the requirements, the solution should include: (1) a DPA for HIPAA plus configuring Azure OpenAI for zero data retention/disable abuse monitoring to prevent data logging/storage; (2) Microsoft Purview Data Loss Prevention (DLP) to block sensitive data, not Content Filtering; (3) Microsoft Purview Data Classification for labeling; (4) Defender for Cloud Apps session policy for exfiltration monitoring; (5) audit logging to Sentinel for anomaly detection; and (6) network/access controls such as Private Endpoint and Conditional Access. No single option includes all necessary controls, but D is closest if corrected.

Answer

Use Azure OpenAI Service with default settings. Implement Microsoft Sentinel to detect threats. Use Azure Policy to enforce tagging of resources. Use Azure AD Conditional Access to require MFA for access.

Answer

Use Azure OpenAI Service with a private endpoint. Deploy Azure Information Protection to classify data. Use Azure Firewall to restrict access. Implement Azure DDoS Protection.

Answer

Use Azure OpenAI Service with managed identity. Configure Conditional Access to restrict access by IP. Use Azure Monitor to track usage. Implement Azure Key Vault for API keys.

Question 13

Refer to the exhibit. You are reviewing a Conditional Access policy in Azure AD. The policy requires MFA and a compliant device for all users and all cloud apps. Some users report that they are able to access apps without being prompted for MFA even though their devices are compliant. What is the most likely reason?

Accepted Answer

The policy is set to 'Report-only' mode. A Conditional Access policy set to 'Report-only' mode evaluates the policy and logs results but does not enforce any controls, such as requiring MFA or a compliant device. Users can access apps without MFA prompts because the policy is not actively blocking or challenging them, even if their devices are compliant. This mode is used for testing before enabling enforcement.

Answer

The policy does not include all cloud apps

Answer

The policy excludes specific locations

Answer

The policy does not include session controls to enforce MFA re-prompt

Question 14

A company is implementing a Zero Trust security model using Microsoft 365 Defender. Which THREE of the following are key principles they should follow?

Accepted Answer

Use least privilege access by limiting user permissions with Just-In-Time and Just-Enough-Access.. Zero Trust mandates least privilege access, and Microsoft 365 Defender integrates with Azure AD Privileged Identity Management (PIM) to enforce Just-In-Time (JIT) and Just-Enough-Access (JEA) policies. This ensures users receive only the permissions necessary for a specific task, for a limited duration, reducing the risk of lateral movement and privilege escalation.

Answer

Trust all traffic originating from within the corporate network.

Answer

Provide implicit trust to known users and devices.

Question 15

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft Teams. You need to prevent users from sharing credit card numbers in Teams chat messages. However, the policy should allow sharing with external vendors if they are in your organization's approved list. What should you configure?

Accepted Answer

Configure a DLP policy with a condition to block sharing of credit card numbers to external users except those from approved domains.. You can configure a DLP policy in Microsoft Purview to block sensitive data like credit card numbers in Teams messages, and use the 'Block sharing to external users except' condition to allow sharing with approved domains. This meets the requirement to prevent sharing with unauthorized external users while allowing sharing with approved vendors. Option B is wrong because blocking all external sharing is too restrictive and does not allow the approved external vendors. Option C is wrong because Information Protection labels do not have the granular control over sharing conditions based on external domains. Option D is wrong because sensitivity labels are not designed for DLP actions such as blocking sharing in Teams chat based on external approval.

Answer

Create a DLP policy that blocks credit card numbers and set the action to 'Block external sharing' for all external users.

Answer

Use Microsoft Purview Information Protection to automatically apply a 'Confidential' label to messages containing credit card numbers and block forwarding.

Answer

Create a sensitivity label for credit card data and publish it to Teams, then configure auto-labeling.

Question 16

Contoso, a healthcare provider, is deploying a new patient portal on Azure App Service that stores electronic health records (EHR) in Azure Cosmos DB for NoSQL. The solution must comply with HIPAA and HITRUST. You need to ensure that data is encrypted at rest and in transit, and that access is restricted based on user roles. Cosmos DB must be configured with a private endpoint to prevent public internet access. You plan to use Azure Key Vault to manage encryption keys. Additionally, the application will access Cosmos DB using a system-assigned managed identity. Which of the following is the most complete and secure design?

Accepted Answer

Enable encryption at rest using a customer-managed key in Azure Key Vault, enforce TLS 1.2, configure a private endpoint for Cosmos DB, and grant the managed identity access via Azure RBAC with a custom role that allows read/write to specific containers.. It provides the most comprehensive security for HIPAA/HITRUST compliance. Customer-managed keys in Azure Key Vault give Contoso control over encryption keys, which is required by HIPAA. TLS 1.2 ensures encryption in transit. A private endpoint for Cosmos DB prevents public internet access, offering better isolation than service endpoints or firewall rules. Finally, granting the managed identity access via Azure RBAC with a custom role allows granular, least-privilege access to specific containers, which is more secure than using built-in roles or connection strings. Option A is wrong because service-managed keys do not provide the key control required for HIPAA, and service endpoints are less secure than private endpoints. Option B is wrong because disabling encryption at rest is a security risk and contrary to compliance requirements; also, storing a read-write key in Key Vault (to be retrieved by the app) is less secure than using managed identity with RBAC. Option C is wrong because firewall rules are less secure than private endpoints, and storing read-write keys in application settings is a security risk.

Answer

Enable encryption at rest using service-managed keys, enforce TLS 1.2, configure a service endpoint for Cosmos DB, and grant the managed identity access using Cosmos DB built-in roles (e.g., Cosmos DB Built-in Data Contributor).

Answer

Disable encryption at rest to improve performance, enforce TLS 1.2, configure a private endpoint, and use the managed identity with a read-write key in Azure Key Vault.

Answer

Enable encryption at rest using service-managed keys, enforce TLS 1.2, configure a firewall to allow only the App Service outbound IP, and use read-write keys in application settings.

Question 17

Which THREE of the following are key components of a security operations strategy according to Microsoft's best practices?

Accepted Answer

Detection and analysis. Detection and analysis is a core component of a security operations strategy because it defines how security events are identified, triaged, and investigated. Microsoft's NIST-based SOC maturity model emphasizes continuous monitoring and analytics (e.g., using Microsoft Sentinel analytics rules, UEBA, and threat intelligence) to reduce mean time to detect (MTTD). Without robust detection and analysis, an organization cannot effectively respond to threats.

Answer

Microsoft Sentinel deployment

Answer

Policy and standards development

Question 18

A company uses Microsoft Entra ID with P2 licenses. They want to implement a Zero Trust approach that requires step-up authentication for accessing high-value data in SharePoint. The solution must use risk-based policies and minimize user friction. Which combination should you recommend?

Accepted Answer

Microsoft Entra Conditional Access with sign-in risk policy and authentication context for sensitive data. It combines Conditional Access with a sign-in risk policy (from Identity Protection) and an authentication context that is applied to sensitive SharePoint data. This enforces step-up authentication only when risk is detected and the user accesses high-value data, minimizing friction for low-risk sessions while meeting Zero Trust requirements.

Answer

Microsoft Entra Conditional Access with trusted locations policy

Answer

Azure AD Conditional Access with MFA for all SharePoint access

Answer

Microsoft Entra Identity Protection user risk policy with MFA

Question 19

Your organization uses Microsoft Purview and Microsoft Sentinel. You need to design a solution that alerts the security team when a user tries to share a file labeled 'Highly Confidential' with an external email address. The alert should include the file name, user, and external recipient. Which two components should you use? (Choose TWO.)

Accepted Answer

Microsoft Sentinel analytics rule that queries DLP audit logs. Options B and E. Microsoft Purview Data Loss Prevention (DLP) policy (E) detects and alerts when a user attempts to share a file labeled 'Highly Confidential' with an external email address, and can include the file name, user, and external recipient in the alert. Microsoft Sentinel analytics rule that queries DLP audit logs (B) ingests the DLP alerts and provides centralized investigation and alerting. Option A (Microsoft Purview Information Protection) is for labeling, not monitoring. Option C (Microsoft Purview Audit) logs events but does not generate proactive alerts. Option D (auto-labeling policy) applies labels but does not generate alerts.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Audit

Answer

Microsoft Purview auto-labeling policy

Question 20

You are designing a secure solution for an Azure Kubernetes Service (AKS) cluster that hosts a critical application. You need to ensure that pods can only communicate with specific back-end services and that traffic is encrypted. What should you implement?

Accepted Answer

Implement Kubernetes network policies and enable mTLS using a service mesh like Istio or Linkerd.. Kubernetes network policies allow you to restrict pod-to-pod communication to specific back-end services, and mutual TLS (mTLS) from a service mesh like Istio or Linkerd encrypts the traffic. Option B is incorrect because network security groups (NSGs) operate at the subnet level and cannot enforce pod-level network policies. Option C is incorrect because Azure Application Gateway Ingress Controller handles inbound traffic from outside the cluster, not pod-to-pod communication. Option D is incorrect because Azure Firewall controls north-south traffic (ingress/egress) and does not manage east-west traffic between pods.

Answer

Use network security groups (NSGs) on the subnet.

Answer

Configure Azure Application Gateway Ingress Controller.

Answer

Deploy Azure Firewall and configure application rules.