SC-100 Multiple Select — 10 Questions

Question 1

A company is designing a data security strategy using Microsoft Purview. They need to identify sensitive data across their data estate, including on-premises SQL Server, Azure SQL Database, and Amazon S3. Which THREE components should they use? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Purview Data Estate Insights. Microsoft Purview Data Estate Insights provides visibility into data estate health and security posture, including sensitive data discovery across on-premises SQL Server, Azure SQL Database, and Amazon S3. It aggregates scan results and offers dashboards to identify where sensitive data resides, enabling targeted classification and protection actions.

Answer

Microsoft Purview External Identities

Answer

Microsoft Purview Compliance Manager

Question 2

Your organization uses Microsoft Purview Information Protection to label sensitive emails. You need to ensure that labels are applied automatically based on content. Which THREE methods can you use?

Accepted Answer

Sensitive information types. Sensitive information types (C) are predefined or custom patterns that detect sensitive data such as credit card numbers or social security numbers, enabling automatic label application. Auto-labeling policies in Microsoft Purview (D) apply labels automatically to emails and files based on conditions like sensitive information types or trainable classifiers. Trainable classifiers (E) use machine learning to identify content patterns and automatically apply labels without requiring explicit pattern definitions.

Answer

Manual labeling by users

Answer

File plan (for records management)

Question 3

Which THREE capabilities does Microsoft Purview provide for compliance management?

Accepted Answer

Information protection with sensitivity labels. Microsoft Purview provides compliance management capabilities including information protection with sensitivity labels, which allow organizations to classify and protect sensitive data across Microsoft 365 services, endpoints, and third-party apps. Sensitivity labels enforce encryption, visual markings, and access restrictions based on policy, directly supporting data loss prevention and governance.

Answer

Identity protection and risk detection

Answer

Endpoint detection and response

Question 4

You are designing a Microsoft Purview data security solution for a multinational organization subject to GDPR and CCPA. Which THREE Purview capabilities should you include to meet regulatory requirements?

Accepted Answer

Data Loss Prevention (DLP) policies. Data Loss Prevention (DLP) policies are correct because they allow the organization to detect and prevent the accidental or intentional sharing of sensitive data—such as personally identifiable information (PII) covered under GDPR and CCPA—across email, SharePoint, OneDrive, and endpoints. By scanning content for sensitive information types (e.g., credit card numbers, EU passport numbers) and applying protective actions (e.g., blocking transmission, showing policy tips), DLP directly enforces data protection mandates required by these regulations.

Answer

Advanced eDiscovery

Answer

Data Lifecycle Management (retention policies)

Question 5

Which TWO Azure policies should you assign to enforce secure configuration of Azure SQL Database? (Select two.)

Accepted Answer

Ensure that 'Auditing' is set to 'On' for SQL Database. Enabling Auditing on Azure SQL Database captures all database events and writes them to an audit log in your Azure storage account, Log Analytics workspace, or Event Hubs. This is a fundamental security control for compliance and forensic analysis, as it provides a record of who did what and when, which is essential for detecting and investigating unauthorized access or changes.

Answer

Ensure that 'TDE' is enabled for SQL Server VMs

Answer

Audit SQL Server level audit setting

Answer

Ensure secure transfer to storage accounts is enabled

Question 6

A company uses Microsoft Intune to manage devices. They need to ensure that only compliant devices can access corporate email. They plan to use Conditional Access in Microsoft Entra ID. Which THREE components must be configured?

Accepted Answer

Device registration in Entra ID. Device registration in Entra ID (A) is required because Conditional Access policies evaluate device compliance based on the device's identity in Entra ID. Without registration, the device lacks a unique identity that Entra ID can assess for compliance status, making it impossible to enforce access controls based on device state.

Answer

Windows Autopilot deployment profile

Answer

Configuration profile in Intune

Question 7

A company is implementing a Zero Trust security model using Microsoft 365 Defender. Which THREE of the following are key principles they should follow?

Accepted Answer

Use least privilege access by limiting user permissions with Just-In-Time and Just-Enough-Access.. Zero Trust mandates least privilege access, and Microsoft 365 Defender integrates with Azure AD Privileged Identity Management (PIM) to enforce Just-In-Time (JIT) and Just-Enough-Access (JEA) policies. This ensures users receive only the permissions necessary for a specific task, for a limited duration, reducing the risk of lateral movement and privilege escalation.

Answer

Trust all traffic originating from within the corporate network.

Answer

Provide implicit trust to known users and devices.

Question 8

Which THREE of the following are key components of a security operations strategy according to Microsoft's best practices?

Accepted Answer

Detection and analysis. Detection and analysis is a core component of a security operations strategy because it defines how security events are identified, triaged, and investigated. Microsoft's NIST-based SOC maturity model emphasizes continuous monitoring and analytics (e.g., using Microsoft Sentinel analytics rules, UEBA, and threat intelligence) to reduce mean time to detect (MTTD). Without robust detection and analysis, an organization cannot effectively respond to threats.

Answer

Microsoft Sentinel deployment

Answer

Policy and standards development

Question 9

You are designing a secure access strategy for Azure App Service web applications. The requirements are: use Azure AD for authentication, restrict access to specific IP ranges, and require multi-factor authentication (MFA) for all users. Which two components should you configure? (Choose two.)

Accepted Answer

Configure Azure App Service authentication with Microsoft Entra ID. Options B and C are correct. Azure App Service authentication can be configured to use Microsoft Entra ID for user authentication, and a Conditional Access policy can enforce MFA and restrict IP ranges. Option A is incorrect because applying an NSG to the App Service subnet is not the direct method for IP restriction; IP restrictions can be configured directly in the App Service settings. Option D is incorrect because Azure Firewall is a network-level firewall and does not handle user authentication or application-level access control. Option E is incorrect because registering the application is a prerequisite but not a component that directly enforces access rules.

Answer

Apply a network security group (NSG) to the App Service subnet

Answer

Deploy Azure Firewall to filter inbound traffic

Answer

Register the application in Microsoft Entra ID

Question 10

A company uses Microsoft Defender for Cloud to assess compliance with Azure Security Benchmark (ASB). The security team wants to ensure that all recommendations are being followed. Which three actions should the team take to manage and remediate recommendations effectively?

Accepted Answer

Enable continuous export of compliance data to Log Analytics or Event Hubs.. Enabling continuous export of compliance data to Log Analytics or Event Hubs allows the security team to centralize, query, and monitor compliance data over time. This is essential for tracking the status of all Azure Security Benchmark recommendations, creating custom alerts, and integrating with SIEM or automation workflows. Option C is correct because creating exemption rules for resources that are compliant by other means (e.g., via a third-party tool or compensating controls) prevents false positives and reduces alert fatigue while maintaining accurate compliance posture. Option D is correct because enabling automatic provisioning of the Log Analytics agent ensures that all supported VMs are monitored and can report their compliance status, which is a foundational requirement for many ASB recommendations. Options B and E are incorrect: manual monthly remediation is not scalable or continuous, and disabling recommendations should be done via exemptions rather than outright disabling to maintain auditability.

Answer

Manually remediate all high-severity recommendations each month.

Answer

Disable recommendations that are not applicable to the environment.