SC-100 Design security solutions for applications and data Practice Test 10 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel to centralize security monitoring. You need to detect anomalous access to a critical Azure SQL Database from unusual geographic locations. Which data connector and analytic rule should you use?

Accepted Answer

Azure SQL Database connector and a custom scheduled query rule with geo-location. Option D is correct because the Azure SQL Database connector ingests diagnostic logs containing connection events, and an analytics rule can detect anomalies by location. Option A is wrong because Azure AD sign-in logs do not include database-level connections. Option B is wrong because Azure Activity logs track control plane operations, not data plane access. Option C is wrong because Windows Security Events are for on-premises servers, not Azure SQL.

Answer

Azure Active Directory connector and an anomaly rule for sign-ins

Answer

Windows Security Events connector and a rule for failed logins

Answer

Azure Activity connector and a rule for resource deletion

Question 2

Your company uses Microsoft Defender for Cloud to secure Azure workloads. You need to ensure that all storage accounts have the 'Secure transfer required' setting enabled. What should you use?

Accepted Answer

Azure Policy. Option A is correct because Azure Policy can audit and enforce the 'Secure transfer required' setting across all storage accounts. Option B is wrong because Defender for Cloud recommendations are not enforced automatically. Option C is wrong because Azure Blueprints are deprecated. Option D is wrong because RBAC does not enforce resource configuration.

Answer

Azure role-based access control (RBAC)

Answer

Azure Blueprints

Answer

Microsoft Defender for Cloud regulatory compliance dashboard

Question 3

A company is implementing Microsoft Priva to manage subject rights requests. Users submit requests to access their personal data stored in Exchange Online, SharePoint, and Teams. The privacy team needs to automate the retrieval of data from these sources. Which Priva capability should they use?

Accepted Answer

Subject Rights Requests. Option C is correct because Priva Subject Rights Requests includes built-in data retrieval from Microsoft 365 sources. Option A is wrong because Data Inventory scans but does not retrieve data for requests. Option B is wrong because Consent Management handles consent, not data retrieval. Option D is wrong because Data Breach Notifications are for incident response.

Answer

Consent Management

Answer

Data Inventory

Answer

Data Breach Notifications

Question 4

Your organization uses Microsoft Entra Verified ID to issue verifiable credentials to employees. You need to design a solution that allows employees to prove their employment status to third-party apps without exposing their full identity. What should you implement?

Accepted Answer

Verifiable credentials with a custom credential type. Option B is correct because a verifiable credential can contain only the attributes required (e.g., employment status) and is presented via a wallet. Option A is wrong because a custom role does not issue credentials. Option C is wrong because Conditional Access controls access but does not issue proofs. Option D is wrong because managed identities are for Azure resources, not user identity.

Answer

Microsoft Entra ID custom roles

Answer

Azure managed identities

Answer

Conditional Access policy with session controls

Question 5

Your organization is developing a Power BI dashboard that uses data from an Azure SQL Database. The data includes personally identifiable information (PII). You need to mask the PII from certain users while allowing full access to data owners. What should you use?

Accepted Answer

Dynamic data masking in Azure SQL Database and row-level security in Power BI. Option A is correct because Power BI row-level security (RLS) can filter data based on user roles, but to mask specific columns, you need dynamic data masking in Azure SQL Database. Option B is wrong because sensitivity labels do not mask data. Option C is wrong because Azure SQL Database auditing logs access, does not mask. Option D is wrong because Microsoft Purview scans data, does not mask.

Answer

Azure SQL Database auditing and Microsoft Defender for Cloud

Answer

Microsoft Purview Data Map and data catalog

Answer

Microsoft Purview sensitivity labels and auto-labeling

Question 6

Your company uses Microsoft Intune to manage mobile devices. You need to ensure that corporate data in Microsoft 365 apps cannot be copied to personal apps on the same device. What should you configure?

Accepted Answer

App protection policy (MAM) with 'Restrict cut, copy, and paste'. Option C is correct because app protection policies (MAM) can prevent data transfer between managed and unmanaged apps. Option A is wrong because conditional access blocks access but does not control copy/paste. Option B is wrong because compliance policies enforce device health, not app-level data movement. Option D is wrong because device configuration profiles set device settings, not app restrictions.

Answer

Conditional Access policy requiring compliant device

Answer

Device configuration profile with restrictions

Answer

Device compliance policy for mobile devices

Question 7

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft 365. You need to create a DLP policy that detects and blocks sharing of credit card numbers in Exchange Online emails. Which TWO components must you configure?

Accepted Answer

Action to block sharing. Option A is correct because a sensitive info type for credit card number is required to identify the data. Option C is correct because the action 'Block' must be set to prevent sharing. Option B is wrong because a retention label is for data retention, not DLP. Option D is wrong because trainable classifiers are for complex patterns, but credit card numbers are predefined. Option E is wrong because auto-labeling is separate from DLP.

Answer

Retention label for financial data

Answer

Auto-labeling policy

Answer

Trainable classifier for credit card numbers

Question 8

A company is designing a solution to protect Azure Functions that process sensitive data. They need to ensure that only authenticated and authorized callers can invoke the function, and that secrets are not hard-coded. Which THREE actions should they take?

Accepted Answer

Use managed identity to access Azure Key Vault for secrets. Option A is correct because using managed identity eliminates secrets in code. Option C is correct because Azure AD authentication validates tokens from callers. Option D is correct because function-level authorization keys (like 'Function' or 'Admin') provide an additional layer. Option B is wrong because connection strings are not for authentication of callers. Option E is wrong because client certificates are not the primary method for caller authentication in Azure Functions; managed identity and Azure AD are preferred.

Answer

Store connection strings in application settings

Answer

Require client certificates

Question 9

Your organization wants to enable Microsoft Defender for Cloud Apps to monitor and control the use of Box and Dropbox. Which TWO steps must you perform?

Accepted Answer

Connect the app using an app connector. Option A is correct because you need to connect the app via an app connector to allow monitoring. Option C is correct because Conditional Access App Control enables session-level control. Option B is wrong because cloud discovery automatically detects apps, but for sanctioned apps you use app connectors. Option D is wrong because you deploy a reverse proxy, not a forward proxy. Option E is wrong because you need to add the app to the sanctioned list after connecting.

Answer

Add Box and Dropbox to the unsanctioned list

Answer

Deploy a forward proxy

Answer

Run a cloud discovery report

Question 10

You are reviewing a Conditional Access policy in Microsoft Entra ID. The policy is intended to block sign-ins from high-risk users. However, some high-risk users are still able to sign in. What is the most likely reason?

Accepted Answer

The policy is not enforced because user risk is not being evaluated (e.g., missing licenses or risk policy). Option C is correct because the policy only blocks based on user risk level, but if the user risk is not evaluated or the policy is not in report-only mode, it may not enforce. However, the exhibit shows the policy is enabled, but if the user risk level is not being calculated in real-time (e.g., due to licensing), it may not trigger. Option A is wrong because locations include all. Option B is wrong because client app types include all. Option D is wrong because the policy is enabled.

Answer

The policy does not include all client app types

Answer

The policy is set to report-only mode

Answer

The policy does not include all locations

Question 11

You have created a custom Azure RBAC role named 'Custom SQL DB Reader' as shown in the exhibit. You assign this role to a user. The user reports they cannot read data from an Azure SQL Database. What is the most likely cause?

Accepted Answer

The Azure SQL Database is not configured to support Azure AD authentication. Option D is correct because the role includes dataActions for read, but Azure SQL Database uses SQL authentication or Azure AD authentication; RBAC dataActions are only effective if the user authenticates via Azure AD and the database is configured to support Azure AD authentication. Option A is wrong because the role includes Microsoft.Sql/servers/databases/read action. Option B is wrong because dataActions are present. Option C is wrong because assignableScopes includes the subscription.

Answer

The role does not include 'Microsoft.Sql/servers/databases/read' action

Answer

The assignableScopes does not include the resource group

Answer

The role does not include any dataActions

Question 12

You are reviewing an ARM template snippet that creates a blob container. The security team requires that the container be accessible only via authorized Azure AD identities, not via anonymous access. Based on the exhibit, is the configuration correct?

Accepted Answer

Yes, the setting 'publicAccess': 'None' prevents anonymous access, and Azure AD authentication is available by default. Option B is correct because 'publicAccess': 'None' ensures no anonymous access, and Azure AD authentication is the default for authorized identities. Option A is wrong because the configuration is correct. Option C is wrong because container-level access is not a separate setting. Option D is wrong because RBAC is already the default for authorized identities; no additional action needed.

Answer

Yes, but you also need to disable shared key access

Answer

No, you need to set 'publicAccess' to 'Blob' to restrict access

Answer

No, you must also configure a firewall rule to restrict access to Azure AD users

Question 13

Your company develops a web application hosted on Azure App Service. The application uses Azure SQL Database and requires managed identities to access the database. You need to ensure that the application can authenticate to Azure SQL without storing credentials in code. Which authentication method should you implement?

Accepted Answer

Enable system-assigned managed identity on the App Service and grant it access to the SQL database.. Option B is correct because system-assigned managed identity is the simplest and most secure way for an Azure App Service to authenticate to Azure SQL without credential storage. Option A is wrong because Azure AD service principals require secret management. Option C is wrong because certificate-based authentication still requires certificate deployment. Option D is wrong because access keys are static credentials.

Answer

Store a client certificate in Azure Key Vault and reference it from the app.

Answer

Use an Azure AD service principal with a client secret.

Answer

Use Azure SQL database-level firewall rules with a static IP restriction.

Question 14

Your organization uses Microsoft Defender for Cloud Apps to protect SaaS applications. You need to configure a policy that blocks downloads of files tagged as 'Highly Confidential' from SharePoint Online and triggers an automated investigation. Which policy type should you use?

Accepted Answer

Access policy. Option C is correct because an access policy in Defender for Cloud Apps can enforce real-time controls like blocking downloads based on sensitivity labels. Option A is wrong because session policy controls user sessions but does not natively block downloads by label. Option B is wrong because app discovery policy discovers shadow IT, not controls access. Option D is wrong because anomaly detection policy detects unusual behavior but does not block downloads.

Answer

Session policy

Answer

App discovery policy

Answer

Anomaly detection policy

Question 15

Your company uses Microsoft Purview to classify and protect sensitive data. You need to ensure that when a user sends an email containing a credit card number, the email is automatically encrypted and a notification is sent to the user. Which Microsoft Purview feature should you configure?

Accepted Answer

Data Loss Prevention (DLP) policies. Option B is correct because Data Loss Prevention (DLP) policies in Microsoft Purview can automatically apply encryption and send notifications when sensitive data is detected in emails. Option A is wrong because sensitivity labels require user action or auto-labeling, but not automatic encryption on send. Option C is wrong because audit logs only record events, not enforce controls. Option D is wrong because insider risk management focuses on user behavior, not content protection.

Answer

Sensitivity labels

Answer

Audit log policies

Answer

Insider risk management policies