SC-100 Design security solutions for applications and data — 30 Questions

Question 1

Your organization is deploying a new line-of-business application on Azure App Service. The app must authenticate users from Microsoft Entra ID and also access a downstream API that requires a client secret. You need to recommend the most secure method for managing the client secret. What should you use?

Accepted Answer

Store the secret in Azure Key Vault and use a Key Vault reference in App Service.. Option C is correct because Azure Key Vault provides secure storage for secrets and certificates, and App Service can reference them via managed identity or Key Vault references. Option A is wrong because storing the secret in code exposes it to source control and accidental disclosure. Option B is wrong because App Service application settings are less secure and can be accessed through the portal. Option D is wrong because Azure AD app registration is the identity object, not a storage for secrets.

Answer

Store the secret in the Azure AD app registration manifest.

Answer

Store the secret in an App Service application setting.

Answer

Store the secret in the application code as a constant.

Question 2

Your company uses Microsoft Defender for Cloud to protect Azure resources. A critical application uses an Azure SQL Database. You need to ensure that all queries to the database are encrypted in transit and that the encryption protocol is the most secure version available. Which configuration should you enforce?

Accepted Answer

Set the minimal TLS version to 1.2 in the server's firewall rules.. Option B is correct because Azure SQL Database supports TLS 1.2 by default and can be enforced via server-level firewall rules or connection policy. Option A is wrong because TCP is a transport protocol, not encryption. Option C is wrong because forcing SSL only ensures encryption but may allow older TLS versions. Option D is wrong because encrypted connections are not the default for all clients; you must enforce minimal TLS version.

Answer

Configure the database to reject unencrypted connections.

Answer

Set the connection policy to Proxy and force TCP.

Answer

Enable 'Force SSL' on the database.

Question 3

Your organization stores sensitive customer data in Azure Blob Storage. You need to implement data classification and labeling using Microsoft Purview. Which resource should you use to automatically scan and classify the data?

Accepted Answer

Microsoft Purview Data Map. Option A is correct because Microsoft Purview Data Map provides automated scanning and classification of data assets across Azure and on-premises. Option B is wrong because Purview Information Protection focuses on labeling and protection policies, not scanning. Option C is wrong because Purview Data Loss Prevention (DLP) monitors and prevents data exfiltration. Option D is wrong because Azure Policy enforces organizational standards, not data classification.

Answer

Azure Policy

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Loss Prevention

Question 4

A company uses Microsoft Entra ID to authenticate users for a web application. They want to enable self-service password reset (SSPR) for users. What is the minimum licensing requirement?

Accepted Answer

Microsoft Entra ID P1. Option B is correct because Microsoft Entra ID P1 includes SSPR with writeback to on-premises Active Directory. Option A is wrong because the free tier does not include SSPR. Option C is wrong because P2 adds Identity Protection, not required for basic SSPR. Option D is wrong because Microsoft 365 E3 includes Entra ID P1, but the question asks for minimum licensing.

Answer

Microsoft 365 E3

Answer

Microsoft Entra ID P2

Answer

Microsoft Entra ID Free

Question 5

Your organization uses Microsoft Defender for Cloud to protect Azure SQL databases. You notice that a particular database is flagged with a high-severity recommendation to enable 'Advanced Data Security'. What does enabling Advanced Data Security provide?

Accepted Answer

It provides vulnerability assessments and threat detection.. Option C is correct because Advanced Data Security (ADS) includes vulnerability assessments, threat detection, and data discovery/classification. Option A is wrong because transparent data encryption (TDE) is a separate feature. Option B is wrong because ADS does not restrict network access; that is firewall or VNet rules. Option D is wrong because backup encryption is handled by Azure Storage encryption.

Answer

It restricts access to the database to specific IP addresses.

Answer

It encrypts the database at rest using TDE.

Answer

It enables automatic backup encryption.

Question 6

Your company is designing a solution to store sensitive documents in Azure Files. The files must be encrypted at rest and in transit. Which two configurations are required? (Each correct answer presents part of the solution.)

Accepted Answer

Enable Azure Storage Service Encryption (SSE) for the storage account.. Option A and B are correct. Encryption at rest is provided by Azure Storage Service Encryption (SSE). Encryption in transit is provided by SMB 3.0 with encryption. Option C is wrong because Azure File Sync does not provide encryption at rest or in transit for the file share itself. Option D is wrong because Azure Disk Encryption is for VMs, not Azure Files. Option E is wrong because TLS is for HTTPS, not SMB.

Answer

Enable Azure Disk Encryption on the VMs that mount the share.

Answer

Configure the storage account to use HTTPS only.

Answer

Use Azure File Sync to sync files to on-premises servers.

Question 7

Your organization uses Microsoft Purview Information Protection to label and protect sensitive emails and documents. You need to ensure that when a user applies a 'Highly Confidential' label, the content is automatically encrypted and a watermark is added. Which configuration should you use?

Accepted Answer

Configure a sensitivity label with encryption and watermark settings.. Option B is correct because a label with protection settings can enforce encryption and apply a watermark. Option A is wrong because the label itself can be configured, not requiring a separate policy. Option C is wrong because DLP policies prevent sharing but do not add watermarks. Option D is wrong because Azure Information Protection is the underlying technology, but the configuration is done via sensitivity labels.

Answer

Use Azure Information Protection scanner to apply labels automatically.

Answer

Create a DLP policy that blocks sharing of highly confidential content.

Answer

Enable Microsoft 365 Message Encryption for all emails.

Question 8

A company uses Azure API Management to expose backend APIs. They need to implement OAuth 2.0 authorization with Microsoft Entra ID. The APIs are called by a SPA application. Which OAuth 2.0 grant type should be used?

Accepted Answer

Authorization code flow with PKCE. Option C is correct because the authorization code flow with PKCE is the recommended grant for SPAs. Option A is wrong because implicit flow is deprecated due to security concerns. Option B is wrong because client credentials is for server-to-server, not user authentication. Option D is wrong because resource owner password credentials (ROPC) is not recommended and requires user credentials.

Answer

Implicit grant

Answer

Resource owner password credentials grant

Answer

Client credentials grant

Question 9

Your organization is planning to use Microsoft Sentinel for security information and event management (SIEM). You need to ingest security logs from on-premises Active Directory. What should you deploy?

Accepted Answer

Azure Monitor Agent. Option A is correct because Azure Monitor Agent is the current agent for collecting Windows events from on-premises VMs and sending to Log Analytics workspace, which is used by Sentinel. Option B is wrong because Log Analytics agent is legacy. Option C is wrong because MMA is also legacy. Option D is wrong because Defender for Cloud agent focuses on security baselines, not general event collection.

Answer

Microsoft Monitoring Agent (MMA)

Answer

Log Analytics agent

Answer

Microsoft Defender for Cloud agent

Question 10

Your company is developing a microservices application that will run on Azure Kubernetes Service (AKS). The application must authenticate to Azure SQL Database using managed identities. Which type of managed identity should you assign to the AKS cluster?

Accepted Answer

User-assigned managed identity and Azure AD Pod Identity. Option B is correct because AKS uses a system-assigned managed identity for the cluster itself to integrate with Azure resources like load balancers. For pods to access Azure SQL, you need a pod identity (like Azure AD Pod Identity) which uses a user-assigned managed identity. Option A is wrong because system-assigned is for cluster, not pods. Option C is wrong because service principal is legacy. Option D is wrong because certificate-based authentication is not managed identity.

Answer

Certificate-based authentication using Azure Key Vault

Answer

System-assigned managed identity on the cluster

Answer

Service principal with client secret

Question 11

Your organization uses Azure Cosmos DB with SQL API. You need to implement data encryption at rest and control access to the encryption keys. Which two actions should you take? (Choose two.)

Accepted Answer

Configure a customer-managed key in Azure Key Vault for encryption.. Options A and B are correct. Option A: Enable server-side encryption (SSE) which is enabled by default but explicitly ensuring it's on is good. Option B: Use customer-managed keys (CMK) stored in Azure Key Vault for key control. Option C is wrong because client-side encryption is not the same as at-rest encryption and adds complexity. Option D is wrong because Azure Disk Encryption is for VMs. Option E is wrong because Data Encryption at rest is not turned off by default in Cosmos DB; it's always on.

Answer

Implement client-side encryption using the .NET SDK.

Answer

Enable Azure Disk Encryption on the VMs that access Cosmos DB.

Answer

Turn off automatic encryption and use a custom encryption algorithm.

Question 12

Your company uses Microsoft Intune to manage mobile devices. You need to protect corporate data on mobile devices by ensuring that work files are encrypted and not accessible by personal apps. What three configurations should you implement? (Choose three.)

Accepted Answer

Enable mobile threat defense (MTD) integration to block risky devices.. Options A, B, and C are correct. App protection policies (MAM) prevent data from being copied to personal apps. Conditional Access with 'Require app protection policy' ensures managed apps are used. Mobile threat defense integration adds security. Option D is wrong because device encryption is device-level, not app-level. Option E is wrong because compliance policies are for device compliance, not data protection on unmanaged devices.

Answer

Require device encryption on all devices.

Answer

Deploy a device compliance policy that requires a PIN.

Question 13

Your organization uses Azure Data Lake Storage Gen2 for big data analytics. You need to secure access to the data using Azure RBAC and ACLs. Which two methods can you use to authorize access? (Choose two.)

Accepted Answer

Assign Azure RBAC roles such as Storage Blob Data Contributor to security principals.. Options A and B are correct. Azure RBAC roles (e.g., Storage Blob Data Contributor) provide coarse-grained access. POSIX-like ACLs provide fine-grained access at directory/file level. Option C is wrong because SAS tokens provide delegated access but not RBAC/ACL. Option D is wrong because managed identity is an identity, not an authorization method. Option E is wrong because firewall rules control network access.

Answer

Configure IP firewall rules to restrict access.

Answer

Use managed identities for Azure resources.

Answer

Generate shared access signatures (SAS) for delegated access.

Question 14

Refer to the exhibit. You are reviewing an Azure Policy definition that uses a 'modify' effect. The policy is intended to automatically enable transparent data encryption (TDE) on Azure SQL databases after they are created. Which condition must be met for the modify effect to work?

Accepted Answer

A managed identity must be associated with the policy assignment and have permissions to modify TDE.. Option D is correct because the modify effect requires a managed identity with the appropriate role (e.g., SQL DB Contributor) to perform the remediation. Option A is wrong because the modify effect does not require a specific SKU. Option B is wrong because the policy can be applied at any scope, including subscription. Option C is wrong because TDE can be enabled on any database, not just new ones.

Answer

The policy must be assigned at the management group scope.

Answer

The database must be newly created.

Answer

The SQL database must be using the General Purpose service tier.

Question 15

Refer to the exhibit. You are analyzing sign-in failures in Microsoft Sentinel using a KQL query. What does this query identify?

Accepted Answer

Accounts that had more than 10 failed logon attempts in the last 7 days.. Option B is correct because the query filters EventID 4625 (failed logon) and groups by Account and Computer, then filters accounts with more than 10 failures in the last 7 days. Option A is wrong because it does not show success events. Option C is wrong because it does not group by IP address. Option D is wrong because it does not include locked accounts.

Answer

Accounts that have been locked out due to multiple failures.

Answer

Computers with more than 10 login attempts from the same IP address.

Answer

Accounts that successfully logged in more than 10 times.

Question 16

Your organization uses Microsoft Defender for Cloud to protect Azure resources. You need to ensure that only authorized applications can access Azure Key Vault secrets. The solution must use managed identities and least privilege. What should you configure?

Accepted Answer

Assign a system-assigned managed identity to the application and grant it Key Vault Secrets User role. Option C is correct because using a system-assigned managed identity and assigning Key Vault access policies with Get and List permissions provides secure, identity-based access with least privilege. Option A is wrong because enabling public network access increases the attack surface. Option B is wrong because shared access signature tokens are less secure and harder to manage. Option D is wrong because certificate-based authentication adds complexity without managed identity benefits.

Answer

Use a shared access signature (SAS) token stored in an environment variable

Answer

Enable public network access on Key Vault and restrict inbound IP addresses

Answer

Install a client certificate on the application server and use it to authenticate to Key Vault

Question 17

You are designing a data classification strategy for Microsoft Purview. The compliance team requires that documents containing personally identifiable information (PII) like credit card numbers are automatically labeled and encrypted when stored in Microsoft SharePoint Online. The solution must use built-in sensitive information types. What should you include in the design?

Accepted Answer

Create a sensitivity label with auto-labeling for credit card numbers and enable encryption. Option D is correct because a sensitivity label with auto-labeling for content matching a sensitive information type (like credit card number) and encryption can be applied to SharePoint documents automatically. Option A is wrong because retention labels do not enforce encryption. Option B is wrong because trainable classifiers require custom training. Option C is wrong because manual labeling is not automatic.

Answer

Create a retention label and apply it automatically via a data loss prevention (DLP) policy

Answer

Use a trainable classifier to detect PII and apply a sensitivity label

Answer

Configure a manual sensitivity label policy for users to apply

Question 18

Your company uses Microsoft Defender for Cloud Apps to discover and control shadow IT. You need to block the use of a newly discovered unsanctioned cloud storage app that poses a high risk. What should you configure?

Accepted Answer

In Defender for Cloud Apps, unsanction the app and create a session policy to block it. Option A is correct because Defender for Cloud Apps allows you to sanction/unsanction apps and create access policies to block unsanctioned apps. Option B is wrong because Conditional Access policies in Entra ID control access but not app blocking. Option C is wrong because Intune compliance policies manage device compliance. Option D is wrong because Defender for Cloud Apps can block apps directly.

Answer

Create a Conditional Access policy in Microsoft Entra ID to block the app

Answer

Use Microsoft Intune to set a compliance policy that blocks the app

Answer

Add the app to the blocked list in Microsoft Defender for Cloud Apps

Question 19

You are designing an API management solution using Azure API Management. The security team requires that all API calls must be authenticated using OAuth 2.0 and that only specific Azure AD applications can access the APIs. Additionally, the solution must support rate limiting and IP filtering. What should you configure?

Accepted Answer

Configure OAuth 2.0 in Azure API Management, use validate-jwt policy to restrict to specific Azure AD apps, and add rate-limit and ip-filter policies. Option B is correct because Azure API Management can validate OAuth tokens, and you can restrict access to specific Azure AD applications using the 'validate-jwt' policy. Rate limiting and IP filtering are also built-in policies. Option A is wrong because it's not a complete solution. Option C is wrong because API keys are less secure. Option D is wrong because client certificates are not OAuth.

Answer

Set up client certificate authentication and map certificates to Azure AD apps

Answer

Enable API key authentication and restrict access using subscription keys

Answer

Use OAuth 2.0 with Azure AD and configure inbound policies to validate JWTs

Question 20

Your organization uses Microsoft Defender for Endpoint (MDE) for endpoint detection and response. You need to protect sensitive data on Windows 10 devices from being exfiltrated via USB drives. The solution must be able to audit file copy operations to USB and block them for high-risk users. What should you configure?

Accepted Answer

Deploy a device control policy in Microsoft Defender for Endpoint to audit USB usage and block for high-risk users. Option D is correct because Microsoft Defender for Endpoint includes device control features that can audit and block removable storage. You can configure policies to audit all users and block for high-risk users using custom device control policies. Option A is wrong because Intune can manage USB restrictions but not with MDE-specific auditing. Option B is wrong because DLP policies in Microsoft Purview are for cloud and network. Option C is wrong because conditional access does not control USB.

Answer

Set up a Conditional Access policy in Microsoft Entra ID to block sign-ins from devices with USB activity

Answer

Use Microsoft Intune to create a device configuration profile that disables USB ports

Answer

Configure a Microsoft Purview DLP policy for endpoint devices