SC-100 Design security solutions for applications and data Practice Test 10 — 15 Questions

Question 1

Your company develops a web application hosted on Azure App Service. The application uses Azure SQL Database and requires managed identities to access the database. You need to ensure that the application can authenticate to Azure SQL without storing credentials in code. Which authentication method should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable system-assigned managed identity on the App Service and grant it access to the SQL database.. Enabling a system-assigned managed identity on Azure App Service allows the application to authenticate to Azure SQL Database without storing any credentials in code. Managed identities are automatically managed by Azure and simplify authentication. Option A is incorrect because storing a client certificate in Key Vault still requires the application to retrieve and use the certificate, which adds complexity and does not eliminate credential management entirely. Option B is incorrect because using an Azure AD service principal with a client secret requires managing the secret, which defeats the purpose of avoiding credential storage. Option C is incorrect because database-level firewall rules with static IP restrictions only control network access, not authentication; they do not provide a way to authenticate without credentials.

Answer

Store a client certificate in Azure Key Vault and reference it from the app.

Answer

Use an Azure AD service principal with a client secret.

Answer

Use Azure SQL database-level firewall rules with a static IP restriction.

Question 2

Your organization uses Microsoft Defender for Cloud Apps to protect SaaS applications. You need to configure a policy that blocks downloads of files tagged as 'Highly Confidential' from SharePoint Online and triggers an automated investigation. Which policy type should you use?

Accepted Answer

Access policy. An access policy in Defender for Cloud Apps can enforce real-time controls like blocking downloads based on sensitivity labels. Option A is wrong because session policy controls user sessions but does not natively block downloads by label. Option B is wrong because app discovery policy discovers shadow IT, not controls access. Option D is wrong because anomaly detection policy detects unusual behavior but does not block downloads.

Answer

Session policy

Answer

App discovery policy

Answer

Anomaly detection policy

Question 3

Your company uses Microsoft Purview to classify and protect sensitive data. You need to ensure that when a user sends an email containing a credit card number, the email is automatically encrypted and a notification is sent to the user. Which Microsoft Purview feature should you configure?

Accepted Answer

Data Loss Prevention (DLP) policies. Data Loss Prevention (DLP) policies in Microsoft Purview are designed to detect sensitive data such as credit card numbers in emails and automatically apply actions like encryption and user notifications. Sensitivity labels (A) require manual or automatic labeling but do not directly enforce encryption on send. Audit log policies (B) only record events, not enforce controls. Insider risk management (C) focuses on user behavior patterns, not content protection.

Answer

Sensitivity labels

Answer

Audit log policies

Answer

Insider risk management policies

Question 4

Your organization uses Microsoft Intune to manage devices. You need to deploy a line-of-business (LOB) app to iOS devices that is not available in the public App Store. The app is signed with an enterprise certificate. Which app deployment method should you use?

Accepted Answer

iOS line-of-business app deployment in Intune. Intune can deploy LOB apps to iOS devices using enterprise certificate signing and MDM distribution. Option A is wrong because Android Enterprise is not for iOS. Option B is wrong because the VPP store only contains public apps. Option C is wrong because Microsoft Store for Business is for Windows apps.

Answer

Android Enterprise managed Google Play

Answer

Volume Purchase Program (VPP) token

Answer

Microsoft Store for Business

Question 5

Your company uses Microsoft Sentinel for security operations. You need to design a solution that automatically remediates a detected threat by blocking a malicious IP address on Azure Firewall. Which Microsoft Sentinel feature should you use?

Accepted Answer

SOAR playbooks. Security Orchestration, Automation, and Response (SOAR) in Microsoft Sentinel uses playbooks to automate remediation actions like blocking IPs on Azure Firewall. Option A is wrong because analytics rules only generate alerts. Option B is wrong because workbooks visualize data. Option D is wrong because UEBA analyzes behavior but does not automate remediation.

Answer

Analytics rules

Answer

Workbooks

Answer

User and Entity Behavior Analytics (UEBA)

Question 6

Your organization uses Microsoft Defender for Cloud to secure multi-cloud workloads. You need to ensure that Azure, AWS, and GCP resources are assessed against a common set of security standards. Which capability should you use?

Accepted Answer

Regulatory compliance standards. Regulatory compliance standards in Microsoft Defender for Cloud allow you to apply common compliance frameworks (e.g., CIS, NIST, PCI DSS) across Azure, AWS, and GCP resources, ensuring they are assessed against a unified set of security standards. Option B (Vulnerability assessment solutions) is incorrect because they are designed to identify specific vulnerabilities in resources, not to enforce compliance standards. Option C (Cloud Security Posture Management) is a broader category that includes posture assessment but does not specifically provide predefined compliance standards. Option D (Just-in-time VM access) is unrelated to compliance assessment; it controls network access to VMs.

Answer

Vulnerability assessment solutions

Answer

Cloud Security Posture Management (CSPM)

Answer

Just-in-time (JIT) VM access

Question 7

Your application uses Azure Key Vault to store secrets. You need to ensure that the application rotates secrets automatically without downtime. Which feature should you enable?

Accepted Answer

Key Vault automatic rotation with Event Grid integration. Key Vault automatic rotation with Event Grid integration enables secrets to be rotated automatically based on a schedule, and the application receives Event Grid notifications before expiration to reload the new secret, ensuring no downtime. Option B is incorrect because manual rotation requires human intervention, which can cause delays and downtime. Option C is incorrect because soft-delete is a recovery feature for accidental deletion, not rotation. Option D is incorrect because RBAC controls access permissions, not secret rotation.

Answer

Key Vault manual rotation

Answer

Key Vault soft-delete

Answer

Key Vault RBAC

Question 8

Your organization uses Microsoft Purview to map and classify data across Azure, on-premises, and multi-cloud sources. You need to ensure that sensitive data assets are automatically discovered and classified. Which Microsoft Purview component should you configure?

Accepted Answer

Data Map scanning. Microsoft Purview Data Map scanning discovers and classifies data assets across sources. Option B is wrong because Data Sharing is for sharing data, not scanning. Option C is wrong because Data Catalog is the inventory of assets, not the scanning component. Option D is wrong because Data Estate Insights provides monitoring and governance insights, not scanning.

Answer

Data Sharing

Answer

Data Catalog

Answer

Data Estate Insights

Question 9

Your organization is deploying a new application on Azure Kubernetes Service (AKS). You need to secure container access to Azure resources using managed identities. Which TWO components are required? (Choose TWO.)

Accepted Answer

Azure AD pod-managed identity (or workload identity). To secure container access using managed identities, the required components are: a supported identity assignment mechanism (such as workload identity) and a location for secret storage (like Azure Key Vault). The Azure AD managed identity itself is provisioned separately and is not listed as an option. Therefore, the correct answers are B and D.

Answer

Pod identity (e.g., aad-pod-identity)

Answer

Azure Container Registry

Answer

Azure Firewall

Question 10

Your company uses Microsoft Intune to manage corporate devices. You need to protect company data on devices by preventing data leakage to personal apps. Which TWO policies should you configure? (Choose TWO.)

Accepted Answer

App protection policies (MAM). Correct answers are App protection policies (MAM) and Conditional access policies requiring approved client apps. App protection policies (MAM) prevent data leakage by controlling how data is shared between managed and unmanaged apps, even on personally-owned devices. Conditional access policies requiring approved client apps ensure that access to corporate data is only granted through managed apps that comply with app protection policies, further preventing data leakage. Device compliance policies focus on device health and are not directly about data leakage prevention. Device configuration profiles set device settings but do not prevent data leakage. Windows Information Protection (WIP) is a data protection feature for Windows devices, but it is not as cross-platform as MAM policies and is not the recommended approach for modern management with Intune.

Answer

Device compliance policies

Answer

Device configuration profiles

Answer

Windows Information Protection (WIP)

Question 11

Refer to the exhibit. You are designing an API Management instance for a production environment. The exhibit shows a snippet of an ARM template. Which security concern is most critical to address before deploying to production?

Accepted Answer

The SKU is set to Developer, which is not suitable for production.. The Developer SKU is not suitable for production due to lack of SLA and limited scale. Option A is wrong because disabling TLS 1.0/1.1 and weak ciphers is actually a security best practice. Option B is wrong because the publisher email and name are informational. Option C is wrong because the API version constraint affects feature set, not security.

Answer

Weak TLS cipher suites are enabled.

Answer

Publisher email and name are hardcoded.

Answer

The API version constraint is outdated.

Question 12

Refer to the exhibit. You run the PowerShell script to protect high-confidentiality resources. After execution, you find that some resources with tag 'Confidentiality=High' are still unprotected. What is the most likely reason?

Accepted Answer

Some resources are in a different resource group than expected.. The script uses Get-AzResource to enumerate resources, but then creates locks using -ResourceGroupName parameter. If a resource resides in a different resource group than its parent resource group (e.g., a resource moved or a cross-resource-group reference), the lock creation may fail or apply to the wrong resource group, leaving the resource unprotected. Option B is incorrect because the script does check for existing locks before attempting to create new ones (via the If statement). Option C is incorrect because tag inheritance is not relevant to lock application; tags are used for filtering resources but locks are applied per resource. Option D is incorrect because the script uses New-AzResourceLock with -Force, which does overwrite existing locks, but this does not cause unprotected resources.

Answer

The script does not check for existing locks properly.

Answer

Tags are not inherited from resource groups.

Answer

The script overwrites existing locks.

Question 13

Your organization, Contoso Ltd., is a multinational company with 50,000 employees. They use Microsoft 365 E5, Azure, and Microsoft Sentinel. The security team wants to implement a data security solution that meets the following requirements:

1. All sensitive data stored in SharePoint Online and OneDrive for Business must be automatically classified and protected using sensitivity labels.
2. When a user attempts to share a file labeled 'Highly Confidential' with an external user, the action should be blocked and an alert sent to the security team.
3. The solution must detect and prevent data exfiltration from endpoints by monitoring copy/paste and print actions on sensitive data.
4. All data security events must be centralized in Microsoft Sentinel for correlation and investigation.
5. The solution must comply with regulatory requirements that mandate data retention and eDiscovery capabilities.

You need to design the data security solution. Which combination of Microsoft security components should you use?

Accepted Answer

Microsoft Purview Information Protection, Microsoft Purview DLP, and Microsoft Purview eDiscovery. Microsoft Purview Information Protection auto-labeling policies meet requirement 1. DLP policies in Purview block sharing and alert (requirement 2). Endpoint DLP in Purview monitors copy/paste/print (requirement 3). Purview audit logs are ingested into Microsoft Sentinel (requirement 4). Microsoft Purview eDiscovery and retention policies meet requirement 5. Option A is wrong because Microsoft Intune is for device management and does not provide DLP or eDiscovery, and Microsoft Entra ID is for identity and access management, not data classification or DLP. Option B is wrong because Microsoft Defender for Endpoint focuses on endpoint protection, not data classification or eDiscovery, and Microsoft Sentinel is a SIEM, not a data classification solution. Option C is wrong because Microsoft Defender for Cloud Apps is a CASB and does not provide endpoint DLP or eDiscovery, and Microsoft Entra ID does not provide DLP or eDiscovery.

Answer

Microsoft Intune and Microsoft Entra ID

Answer

Microsoft Defender for Endpoint and Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps and Microsoft Entra ID

Question 14

A company is deploying a new application that will store sensitive customer data in Azure SQL Database. The security team requires that all data at rest be encrypted using a customer-managed key stored in Azure Key Vault. Additionally, they need to ensure that the database can be restored to a point in time and that the encryption key is rotated every 90 days. Which combination of features should you configure?

Accepted Answer

Enable TDE with customer-managed keys in Azure Key Vault and configure automatic key rotation.. Transparent Data Encryption (TDE) with customer-managed keys stored in Azure Key Vault meets the requirement for encryption at rest with customer-managed keys. Azure Key Vault supports automatic key rotation, which can be configured to rotate keys every 90 days. Point-in-time restore (PITR) is a feature of Azure SQL Database that allows restoring to any point within the retention period, independent of the encryption configuration. Option D correctly combines these features. Option A is incorrect because it uses service-managed keys, not customer-managed. Option B, Always Encrypted, provides column-level encryption but is more granular than required and requires manual rotation. Option C refers to Azure Storage Service Encryption, which is for Azure Blob Storage, not Azure SQL Database.

Answer

Enable TDE with service-managed keys and use Azure Policy to enforce rotation.

Answer

Use Always Encrypted with column master key in Azure Key Vault and manual rotation.

Answer

Use Azure Storage Service Encryption with customer-managed keys and enable soft delete.

Question 15

You are designing security for a web application that will be developed by an external vendor. The vendor will have access to the source code repository and the development environment. You need to ensure that no secrets (e.g., API keys, connection strings) are stored in the source code. What is the best approach to manage secrets for this application?

Accepted Answer

Use Azure Key Vault to store secrets and configure the application to use managed identity to retrieve them.. Using Azure Key Vault to store secrets and referencing them from the application is the standard best practice. The application can use managed identity to authenticate to Key Vault securely. Storing secrets in app settings is not secure if the repository is accessible. Using environment variables is better but still not as secure as Key Vault. Hardcoding is unacceptable.

Answer

Store secrets in environment variables on the application server.

Answer

Store secrets in Azure App Service application settings encrypted at rest.

Answer

Embed secrets in the compiled code using obfuscation.