SC-100 Design security solutions for applications and data — 50 Questions

Question 1

Your company uses Microsoft Defender for Cloud to protect Azure resources. A critical application uses an Azure SQL Database. You need to ensure that all queries to the database are encrypted in transit and that the encryption protocol is the most secure version available. Which configuration should you enforce?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the minimal TLS version to 1.2 in the server's firewall rules.. Enforcing a minimal TLS version of 1.2 in the server's firewall rules ensures that all connections use TLS 1.2 or higher, which is the most secure encryption protocol available for Azure SQL Database. Option B is incorrect because rejecting unencrypted connections only enforces encryption but does not specify the TLS version, allowing older, less secure versions. Option C is incorrect because setting the connection policy to Proxy and forcing TCP does not affect encryption or TLS version. Option D is incorrect because 'Force SSL' only mandates encryption but does not restrict the TLS version, potentially allowing TLS 1.0 or 1.1.

Answer

Configure the database to reject unencrypted connections.

Answer

Set the connection policy to Proxy and force TCP.

Answer

Enable 'Force SSL' on the database.

Question 2

Your organization stores sensitive customer data in Azure Blob Storage. You need to implement data classification and labeling using Microsoft Purview. Which resource should you use to automatically scan and classify the data?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map is the correct resource because it provides automated scanning and classification of data assets across Azure and on-premises sources. Azure Policy (A) is used for enforcing organizational standards and compliance, not for data classification. Microsoft Purview Information Protection (C) focuses on applying labels and protection policies to already classified data, not on scanning. Microsoft Purview Data Loss Prevention (D) monitors and prevents data exfiltration based on sensitivity labels, but does not perform the initial scanning and classification.

Answer

Azure Policy

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Loss Prevention

Question 3

A company uses Microsoft Entra ID to authenticate users for a web application. They want to enable self-service password reset (SSPR) for users. What is the minimum licensing requirement?

Accepted Answer

Microsoft Entra ID P1. Microsoft Entra ID P1. This edition includes self-service password reset (SSPR) for cloud users, which meets the requirement. Option A (Microsoft 365 E3) includes Entra ID P1 but is a broader subscription; the minimum licensing is simply Entra ID P1. Option B (Entra ID P2) adds Identity Protection and is not required. Option C (Entra ID Free) does not include SSPR.

Answer

Microsoft 365 E3

Answer

Microsoft Entra ID P2

Answer

Microsoft Entra ID Free

Question 4

Your organization uses Microsoft Defender for Cloud to protect Azure SQL databases. You notice that a particular database is flagged with a high-severity recommendation to enable 'Advanced Data Security'. What does enabling Advanced Data Security provide?

Accepted Answer

It provides vulnerability assessments and threat detection.. Advanced Data Security (ADS) includes vulnerability assessments, threat detection, and data discovery/classification. Option A is incorrect because restricting access to specific IP addresses is done via firewall or VNet rules, not by ADS. Option B is incorrect because transparent data encryption (TDE) is a separate feature for encryption at rest, not part of ADS. Option D is incorrect because backup encryption is handled by Azure Storage encryption, not ADS.

Answer

It restricts access to the database to specific IP addresses.

Answer

It encrypts the database at rest using TDE.

Answer

It enables automatic backup encryption.

Question 5

Your company is designing a solution to store sensitive documents in Azure Files. The files must be encrypted at rest and in transit. Which two configurations are required? (Each correct answer presents part of the solution.)

Accepted Answer

Enable Azure Storage Service Encryption (SSE) for the storage account.. Encryption at rest for Azure Files is provided by Azure Storage Service Encryption (SSE), which is enabled by default and cannot be disabled for storage accounts. Encryption in transit is achieved by requiring SMB 3.0 with encryption for the file share. Therefore, options C and D are correct. Option A is incorrect because Azure Disk Encryption encrypts the OS and data disks of VMs, not the file share itself. Option B is incorrect because configuring HTTPS only applies to the REST API and does not affect SMB-based file share access. Option E is incorrect because Azure File Sync is a synchronization tool and does not directly provide encryption for the file share.

Answer

Enable Azure Disk Encryption on the VMs that mount the share.

Answer

Configure the storage account to use HTTPS only.

Answer

Use Azure File Sync to sync files to on-premises servers.

Question 6

Your organization uses Microsoft Purview Information Protection to label and protect sensitive emails and documents. You need to ensure that when a user applies a 'Highly Confidential' label, the content is automatically encrypted and a watermark is added. Which configuration should you use?

Accepted Answer

Configure a sensitivity label with encryption and watermark settings.. Sensitivity labels in Microsoft Purview Information Protection can be configured with encryption and content marking (watermark) settings, which are applied automatically when users apply the label. Option A is incorrect: the Azure Information Protection scanner discovers and labels existing files but does not configure label settings; the label itself must be defined. Option B is incorrect: a DLP policy can block sharing but cannot add watermarks or encrypt content on its own. Option D is incorrect: Microsoft 365 Message Encryption provides encryption for email transport but does not apply watermarks or enforce labels.

Answer

Use Azure Information Protection scanner to apply labels automatically.

Answer

Create a DLP policy that blocks sharing of highly confidential content.

Answer

Enable Microsoft 365 Message Encryption for all emails.

Question 7

A company uses Azure API Management to expose backend APIs. They need to implement OAuth 2.0 authorization with Microsoft Entra ID. The APIs are called by a SPA application. Which OAuth 2.0 grant type should be used?

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE is the recommended grant for SPAs. Option A is wrong because implicit flow is deprecated due to security concerns. Option B is wrong because resource owner password credentials (ROPC) is not recommended and requires user credentials. Option D is wrong because client credentials grant is for server-to-server, not user authentication.

Answer

Implicit grant

Answer

Resource owner password credentials grant

Answer

Client credentials grant

Question 8

Your organization is planning to use Microsoft Sentinel for security information and event management (SIEM). You need to ingest security logs from on-premises Active Directory. What should you deploy?

Accepted Answer

Azure Monitor Agent. Azure Monitor Agent. Azure Monitor Agent is the current and recommended agent for collecting Windows events from on-premises VMs and sending them to a Log Analytics workspace, which is used by Microsoft Sentinel. Option A (Microsoft Monitoring Agent) and Option B (Log Analytics agent) are legacy agents that are being phased out. Option C (Microsoft Defender for Cloud agent) is used for security posture management and not primarily for general event ingestion into Sentinel.

Answer

Microsoft Monitoring Agent (MMA)

Answer

Log Analytics agent

Answer

Microsoft Defender for Cloud agent

Question 9

Your company is developing a microservices application that will run on Azure Kubernetes Service (AKS). The application must authenticate to Azure SQL Database using managed identities. Which type of managed identity should you assign to the AKS cluster?

Accepted Answer

User-assigned managed identity and Azure AD Pod Identity. Azure AD Pod Identity (or its successor, Workload Identity) allows AKS pods to assume a user-assigned managed identity, enabling them to authenticate to Azure SQL Database without managing secrets. Option B (system-assigned managed identity) is assigned to the AKS cluster node resource group, not to individual pods, and cannot be used directly by pods to access Azure SQL. Option A (certificate-based authentication via Key Vault) is a valid approach but requires secret management, not managed identity. Option C (service principal with client secret) is a legacy method that involves managing credentials, which contradicts the goal of using managed identities.

Answer

Certificate-based authentication using Azure Key Vault

Answer

System-assigned managed identity on the cluster

Answer

Service principal with client secret

Question 10

Your organization uses Azure Cosmos DB with SQL API. You need to implement data encryption at rest and control access to the encryption keys. Which two actions should you take? (Choose two.)

Accepted Answer

Configure a customer-managed key in Azure Key Vault for encryption.. Options C and E are correct. Option C: Configuring a customer-managed key in Azure Key Vault allows you to control the encryption keys used for Cosmos DB at rest. Option E: Server-side encryption (SSE) is enabled by default in Azure Cosmos DB, but explicitly ensuring it's on is a best practice. Option A is incorrect because client-side encryption is for encrypting data on the client side before sending to the database, not for at-rest encryption. Option B is incorrect because Azure Disk Encryption encrypts VM disks, not Cosmos DB data. Option D is incorrect because Cosmos DB always encrypts data at rest automatically; you cannot turn it off.

Answer

Implement client-side encryption using the .NET SDK.

Answer

Enable Azure Disk Encryption on the VMs that access Cosmos DB.

Answer

Turn off automatic encryption and use a custom encryption algorithm.

Question 11

Your company uses Microsoft Intune to manage mobile devices. You need to protect corporate data on mobile devices by ensuring that work files are encrypted and not accessible by personal apps. What three configurations should you implement? (Choose three.)

Accepted Answer

Enable mobile threat defense (MTD) integration to block risky devices.. Options B, D, and E are correct. Mobile threat defense integration (B) blocks risky devices from accessing corporate data. An app protection policy (D) encrypts work data and prevents save-as to personal locations, ensuring data stays within managed apps. Conditional Access with 'Require app protection policy' (E) ensures only apps that support MAM policies can access corporate data. Option A (device encryption) is device-level and does not prevent data from being copied to personal apps. Option C (PIN policy) is a device compliance setting, not a data protection mechanism on unmanaged devices.

Answer

Require device encryption on all devices.

Answer

Deploy a device compliance policy that requires a PIN.

Question 12

Your organization uses Azure Data Lake Storage Gen2 for big data analytics. You need to secure access to the data using Azure RBAC and ACLs. Which two methods can you use to authorize access? (Choose two.)

Accepted Answer

Assign Azure RBAC roles such as Storage Blob Data Contributor to security principals.. Options B and C are correct. Azure RBAC roles such as Storage Blob Data Contributor provide coarse-grained access control for Azure Data Lake Storage Gen2. POSIX-like access control lists (ACLs) allow fine-grained permissions on directories and files. Option A is incorrect because IP firewall rules control network-level access, not authorization. Option D is incorrect because managed identities are an identity type, not an authorization method. Option E is incorrect because shared access signatures (SAS) provide delegated access, but the question specifically asks for authorization using Azure RBAC and ACLs.

Answer

Configure IP firewall rules to restrict access.

Answer

Use managed identities for Azure resources.

Answer

Generate shared access signatures (SAS) for delegated access.

Question 13

Refer to the exhibit. You are reviewing an Azure Policy definition that uses a 'modify' effect. The policy is intended to automatically enable transparent data encryption (TDE) on Azure SQL databases after they are created. Which condition must be met for the modify effect to work?

Accepted Answer

A managed identity must be associated with the policy assignment and have permissions to modify TDE.. The 'modify' effect in Azure Policy requires a managed identity to perform the remediation action. Without a managed identity that has permissions (e.g., SQL DB Contributor role) to enable TDE, the policy cannot apply the modify effect. Option B correctly identifies this requirement. Option A is wrong because the modify effect can be assigned at any scope, not just management group. Option C is wrong because the modify effect can remediate existing resources, not just newly created ones. Option D is wrong because TDE is supported across all service tiers, including Basic, General Purpose, and Business Critical.

Answer

The policy must be assigned at the management group scope.

Answer

The database must be newly created.

Answer

The SQL database must be using the General Purpose service tier.

Question 14

Refer to the exhibit. You are analyzing sign-in failures in Microsoft Sentinel using a KQL query. What does this query identify?

Accepted Answer

Accounts that had more than 10 failed logon attempts in the last 7 days.. The query filters for EventID 4625 (failed logon events) and groups by Account, then counts occurrences. It then filters for accounts with a count greater than 10, meaning more than 10 failed logon attempts in the last 7 days. Therefore, the query identifies accounts with more than 10 failed logon attempts. Option B is incorrect because the query groups by Account, not by Computer and IP address. Option A is incorrect because the query does not show success events. Option D is incorrect because the query does not include locked accounts.

Answer

Accounts that have been locked out due to multiple failures.

Answer

Computers with more than 10 login attempts from the same IP address.

Answer

Accounts that successfully logged in more than 10 times.

Question 15

Your organization uses Microsoft Defender for Cloud to protect Azure resources. You need to ensure that only authorized applications can access Azure Key Vault secrets. The solution must use managed identities and least privilege. What should you configure?

Accepted Answer

Assign a system-assigned managed identity to the application and grant it Key Vault Secrets User role. Assigning a system-assigned managed identity to the application and granting it the Key Vault Secrets User role (RBAC) provides secure, identity-based access with least privilege. Managed identities eliminate the need for credentials, and the role grants only the necessary permissions. Option A is wrong because SAS tokens are not for authentication to Key Vault; they are for storage accounts and are less secure. Option C is wrong because enabling public network access increases the attack surface, and IP restrictions are not a secure authentication method. Option D is wrong because certificate-based authentication adds complexity and does not leverage managed identities for least privilege.

Answer

Use a shared access signature (SAS) token stored in an environment variable

Answer

Enable public network access on Key Vault and restrict inbound IP addresses

Answer

Install a client certificate on the application server and use it to authenticate to Key Vault

Question 16

You are designing a data classification strategy for Microsoft Purview. The compliance team requires that documents containing personally identifiable information (PII) like credit card numbers are automatically labeled and encrypted when stored in Microsoft SharePoint Online. The solution must use built-in sensitive information types. What should you include in the design?

Accepted Answer

Create a sensitivity label with auto-labeling for credit card numbers and enable encryption. A sensitivity label with auto-labeling configured to detect sensitive information types like credit card numbers can automatically apply the label and encryption to documents in SharePoint Online. Option B is incorrect because retention labels manage data retention, not encryption. Option C is incorrect because trainable classifiers require custom training and are not built-in sensitive information types. Option D is incorrect because manual labeling requires user action and does not meet the automatic requirement.

Answer

Create a retention label and apply it automatically via a data loss prevention (DLP) policy

Answer

Use a trainable classifier to detect PII and apply a sensitivity label

Answer

Configure a manual sensitivity label policy for users to apply

Question 17

Your company uses Microsoft Defender for Cloud Apps to discover and control shadow IT. You need to block the use of a newly discovered unsanctioned cloud storage app that poses a high risk. What should you configure?

Accepted Answer

In Defender for Cloud Apps, unsanction the app and create a session policy to block it. Defender for Cloud Apps allows you to sanction/unsanction apps and create access policies to block unsanctioned apps. Option B is wrong because Conditional Access policies in Entra ID control access but not app blocking. Option C is wrong because Intune compliance policies manage device compliance. Option D is wrong because Defender for Cloud Apps can block apps directly.

Answer

Create a Conditional Access policy in Microsoft Entra ID to block the app

Answer

Use Microsoft Intune to set a compliance policy that blocks the app

Answer

Add the app to the blocked list in Microsoft Defender for Cloud Apps

Question 18

Your organization uses Microsoft Defender for Endpoint (MDE) for endpoint detection and response. You need to protect sensitive data on Windows 10 devices from being exfiltrated via USB drives. The solution must be able to audit file copy operations to USB and block them for high-risk users. What should you configure?

Accepted Answer

Deploy a device control policy in Microsoft Defender for Endpoint to audit USB usage and block for high-risk users. Microsoft Defender for Endpoint includes device control features that can audit and block removable storage. You can configure policies to audit all users and block for high-risk users using custom device control policies. Option A is wrong because Intune can manage USB restrictions but not with MDE-specific auditing. Option B is wrong because DLP policies in Microsoft Purview are for cloud and network. Option C is wrong because conditional access does not control USB.

Answer

Set up a Conditional Access policy in Microsoft Entra ID to block sign-ins from devices with USB activity

Answer

Use Microsoft Intune to create a device configuration profile that disables USB ports

Answer

Configure a Microsoft Purview DLP policy for endpoint devices

Question 19

You are designing a secure DevOps pipeline using GitHub Actions and Azure. The security team requires that all container images pushed to Azure Container Registry (ACR) are scanned for vulnerabilities before deployment. If critical vulnerabilities are found, the pipeline must fail. What should you integrate into the pipeline?

Accepted Answer

Integrate Microsoft Defender for Cloud with Azure Container Registry scanning and configure a GitHub Actions step to check scan results. Microsoft Defender for Cloud can scan container images in Azure Container Registry (ACR) for vulnerabilities and integrate with GitHub Actions. You can configure a GitHub Actions step to check the scan results and fail the pipeline if critical vulnerabilities are found. Option A is incorrect because Azure Policy can enforce compliance but cannot scan images for vulnerabilities. Option C is incorrect because Azure Bastion is for secure remote access to virtual machines, not for image scanning. Option D is incorrect because Azure Security Center (legacy) is now part of Microsoft Defender for Cloud, and the modern approach is to use Defender for Cloud's integrated scanning with ACR.

Answer

Configure Azure Policy to require image scanning before deployment

Answer

Deploy Azure Bastion to scan images during build

Answer

Use Azure Security Center (legacy) to scan images on push

Question 20

Your company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. You need to prevent users from sharing credit card numbers via email in Outlook on the web. The policy should notify users when they try to send such data and allow them to override with a business justification. What should you configure?

Accepted Answer

Create a DLP policy with the action 'Block with override' and enable 'Business justification'. It uses the 'Block with override' action and enables business justification, which meets the requirement to prevent sharing credit card numbers via email while allowing users to override with a justification. Option A is wrong because 'Audit only' only logs activity and does not block or notify users. Option C is wrong because encrypting the email does not prevent the sharing; it still allows sending but encrypts the content. Option D is wrong because 'Block' without override does not allow users to override with a business justification.

Answer

Create a DLP policy with the action 'Audit only' for credit card numbers

Answer

Create a DLP policy that encrypts emails containing credit card numbers

Answer

Create a DLP policy with the action 'Block' for credit card numbers