SC-100 Design security solutions for applications and data Practice Test 10 — 15 Questions

Question 1

Your organization is implementing a secure DevOps pipeline for Azure. You need to ensure that secrets (e.g., API keys) are not stored in source code and that access to production resources is controlled. Which THREE practices should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Azure Key Vault to store secrets and retrieve them at deployment time. Option B is correct because Azure Key Vault is the dedicated Azure service for centrally storing and managing secrets such as API keys, with encryption at rest and fine-grained access policies, so pipeline code never contains the secret values. Option C is correct because Azure DevOps variable groups can be linked to Azure Key Vault, which lets pipelines consume Key Vault secrets as variables at runtime without duplicating or hardcoding them in the pipeline definition. Option E is correct because managed identities for Azure resources give the pipeline or compute an automatically managed identity in Microsoft Entra ID, allowing it to authenticate to Key Vault without storing credentials, which directly supports controlled access to production resources. Option A is not correct because pipeline variables with encryption enabled still store the secret within Azure DevOps rather than in a dedicated vault, lacking Key Vault's centralized governance, rotation, and auditing. Option D is not correct because a configuration file in a private Git repository still places secrets in source control, which is exactly the practice the scenario requires avoiding.

Answer

Store secrets in Azure DevOps pipeline variables with encryption enabled

Answer

Store secrets in a configuration file in a private Git repository

Question 2

Your organization is designing a new application that will store sensitive customer data in Azure Cosmos DB. You need to ensure that data at rest is encrypted using a customer-managed key (CMK) stored in Azure Key Vault. What should you configure?

Accepted Answer

Configure a customer-managed key in Azure Key Vault and assign it to the Cosmos DB account.. Option D is correct because Azure Cosmos DB supports encryption at rest with customer-managed keys (CMKs), which are created and stored in Azure Key Vault and then assigned to the Cosmos DB account via its encryption settings. This satisfies the requirement to control the key used for data-at-rest encryption rather than relying on Microsoft-managed keys. Option A is incorrect because Transparent Data Encryption (TDE) is an Azure SQL feature, not a Cosmos DB configuration. Option B is incorrect because Azure Storage Service Encryption (SSE) applies to Azure Storage services, not Cosmos DB. Option C is incorrect because Always Encrypted is an Azure SQL Database/client-side encryption feature and does not configure CMK encryption for Cosmos DB.

Answer

Enable Transparent Data Encryption (TDE) on the Cosmos DB account.

Answer

Enable Azure Storage Service Encryption (SSE) on the Cosmos DB account.

Answer

Use Always Encrypted with Azure SQL Database.

Question 3

Your company uses Microsoft Purview to classify and protect sensitive data. You need to automatically detect and protect credit card numbers in documents stored in SharePoint Online. Which solution should you implement?

Accepted Answer

Create a Data Loss Prevention (DLP) policy to detect credit card numbers and block sharing.. The correct answer is C: create a Data Loss Prevention (DLP) policy to detect credit card numbers and block sharing. In Microsoft Purview, DLP policies are the built-in mechanism that inspects SharePoint Online content for sensitive information types such as credit card numbers and enforces protective actions like blocking external sharing or restricting access. This directly matches the requirement to automatically detect and protect credit card numbers in SharePoint Online documents. Option A is incorrect because Azure Information Protection is a labeling/encryption client, not a policy engine that automatically detects sensitive data in SharePoint. Option B is incomplete because a sensitivity label alone does not automatically detect credit card numbers unless combined with auto-labeling conditions, and it does not block sharing. Option D is incorrect because Defender for Cloud Apps focuses on cloud app discovery, session controls, and anomaly detection rather than enforcing DLP rules on SharePoint content.

Answer

Configure Azure Information Protection to automatically apply protection.

Answer

Apply a sensitivity label that encrypts documents with credit card numbers.

Answer

Use Microsoft Defender for Cloud Apps to scan documents for credit card numbers.

Question 4

You are designing a microservices application running on Azure Kubernetes Service (AKS). You need to ensure that secrets (e.g., API keys, connection strings) are securely stored and automatically rotated without application downtime. What is the recommended approach?

Accepted Answer

Use Azure Key Vault with the Secrets Store CSI driver to mount secrets as volumes and enable rotation.. The Azure Key Vault provider for the Secrets Store CSI driver mounts secrets from Azure Key Vault as volumes in AKS pods and supports auto-rotation via the secret rotation feature, which periodically re-fetches updated secrets and updates the mounted files without restarting the application. This satisfies the requirement for secure storage in Key Vault plus automatic rotation with no downtime. Option A is aimed at application configuration scenarios and does not natively mount or rotate secrets into AKS pods. Option B stores secrets in Kubernetes Secrets, which are only base64-encoded and lack the managed rotation and centralized security of Key Vault. Option D injects secrets as environment variables, which cannot be updated in a running container without a pod restart, causing downtime.

Answer

Store secrets in Azure App Configuration with key vault references.

Answer

Store secrets as Kubernetes Secrets and use a controller to rotate them.

Answer

Inject secrets as environment variables from Azure Key Vault using a pod identity.

Question 5

Your organization uses Microsoft Entra ID for identity and access management. You are developing a web application that needs to access Microsoft Graph API on behalf of the signed-in user. Which authentication flow should you implement?

Accepted Answer

Authorization Code Flow with PKCE. Authorization Code Flow with PKCE (C) is correct because it is the recommended OAuth 2.0 flow for web applications that call Microsoft Graph on behalf of a signed-in user, exchanging the authorization code for delegated access and refresh tokens while PKCE protects the code exchange against interception. Implicit Flow (A) is deprecated for this purpose and returns tokens directly from the authorization endpoint without an authorization code, offering weaker security. Client Credentials Flow (B) is app-only and has no signed-in user, so it cannot act on behalf of a user. Device Code Flow (D) is intended for input-constrained devices, not a standard web application with a browser-based sign-in.

Answer

Implicit Flow

Answer

Client Credentials Flow

Answer

Device Code Flow

Question 6

You are designing a solution to protect an Azure App Service web application from common web attacks like SQL injection and cross-site scripting. What should you implement?

Accepted Answer

Azure Web Application Firewall (WAF) policy on Azure Front Door. Azure Web Application Firewall (WAF) policy on Azure Front Door (option C) is correct because WAF is specifically designed to inspect HTTP/HTTPS traffic and block Layer 7 attacks such as SQL injection and cross-site scripting using managed rule sets (OWASP rules). Azure Front Door provides global edge delivery and integrates WAF policies directly, making it the appropriate choice for protecting a public web application. Azure Firewall (A) is a Layer 3-4 network firewall with limited FQDN filtering and does not provide OWASP-style web attack protection. Azure DDoS Protection (B) mitigates volumetric and protocol-level attacks, not application-layer injection or scripting attacks. NSGs (D) filter traffic by IP, port, and protocol at the network layer and cannot inspect HTTP payloads for SQLi or XSS.

Answer

Azure Firewall

Answer

Azure DDoS Protection

Answer

Network Security Groups (NSGs) on the subnet

Question 7

Your company uses Microsoft Purview to manage data governance. You need to create a data classification rule that scans Azure Data Lake Storage for personally identifiable information (PII) such as email addresses. The rule must also apply a sensitivity label automatically. Which approach should you use?

Accepted Answer

Create a custom scan rule in Microsoft Purview and configure auto-labeling.. The correct option is B: create a custom scan rule in Microsoft Purview and configure auto-labeling. Microsoft Purview is the data governance service that supports scanning Azure Data Lake Storage with custom classification rules (using regex or dictionaries) to detect PII such as email addresses, and its auto-labeling policies can then apply sensitivity labels automatically to matching content. Option A is wrong because Azure Policy enforces resource configuration and compliance, not content-level PII detection or sensitivity labeling. Option C is wrong because Power Automate is a workflow automation tool and does not provide Purview's built-in classification scanning for Data Lake Storage. Option D is wrong because Microsoft Defender for Cloud focuses on security posture and threat protection, not data classification or sensitivity labeling.

Answer

Create an Azure Policy to detect and label PII.

Answer

Use a Power Automate flow to scan files and apply labels.

Answer

Use Microsoft Defender for Cloud to scan for PII.

Question 8

You are designing a CI/CD pipeline for a containerized application using Azure DevOps. You need to ensure that container images are scanned for vulnerabilities before being deployed to production. Which service should you integrate?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud [CORRECT] is the right choice because it provides container image vulnerability scanning for images stored in Azure Container Registry and can be integrated into CI/CD workflows to gate deployments before production. It continuously assesses images and surfaces findings that Azure DevOps pipelines can act on. Azure Policy is for enforcing governance and compliance rules on resources, not for scanning container images for vulnerabilities. Azure Key Vault manages secrets and keys, and Azure Monitor collects telemetry and logs, so neither performs vulnerability scanning.

Answer

Azure Policy

Answer

Azure Key Vault

Answer

Azure Monitor

Question 9

Your organization is adopting Microsoft Copilot for Microsoft 365. You need to ensure that Copilot respects the existing sensitivity labels when processing data. What should you configure?

Accepted Answer

Configure sensitivity labels in Microsoft Purview Information Protection.. The correct option is B: Configure sensitivity labels in Microsoft Purview Information Protection. Copilot for Microsoft 365 honors the sensitivity labels applied to content, so labels must be defined and published through Microsoft Purview Information Protection (the current unified labeling platform) for Copilot to respect classification and protection settings such as encryption and content marking. DLP policies (A) enforce rules on sharing or handling of sensitive data but do not provide the classification metadata Copilot uses to respect sensitivity. Azure Information Protection (C) is the legacy labeling client/service being retired in favor of Purview Information Protection, so it is not the configuration target. Retention labels (D) govern lifecycle and retention, not sensitivity-based protection, so they do not control how Copilot treats sensitive content.

Answer

Create Data Loss Prevention (DLP) policies.

Answer

Use Azure Information Protection.

Answer

Apply retention labels to documents.

Question 10

You need to design a secure solution for a web application that authenticates users via Microsoft Entra ID and calls a downstream API. Which TWO should you implement to secure the application? (Choose TWO.)

Accepted Answer

Use the OAuth 2.0 authorization code flow with PKCE.. Option A is correct because the OAuth 2.0 authorization code flow with PKCE is the recommended pattern for interactive web applications that sign users in through Microsoft Entra ID and then call a downstream API on the user's behalf; PKCE protects the authorization code exchange against interception, and the resulting access token is presented to the API. Option B is correct because confidential client applications still need credentials (client secrets or certificates), and Azure Key Vault provides centralized, access-controlled, audited storage for those secrets instead of leaving them in code or config. Option C is wrong because storing secrets in app configuration files exposes them to anyone with file or repository access and is not a secure secret-management practice. Option D is wrong for this scenario because the client credentials flow is a daemon/app-only flow with no user context, so it cannot authenticate interactive users. Option E is wrong because shared access signatures are an Azure Storage authorization mechanism, not an authentication protocol for a Microsoft Entra ID-protected web API.

Answer

Store application secrets in app configuration files.

Answer

Use the OAuth 2.0 client credentials flow.

Answer

Use shared access signatures (SAS) for API authentication.

Question 11

Your organization uses Microsoft Purview to protect sensitive data. You need to implement a solution that automatically detects and protects personally identifiable information (PII) in Microsoft 365. Which THREE should be part of your solution? (Choose THREE.)

Accepted Answer

Microsoft Purview Information Protection scanner. Sensitivity labels in Microsoft Purview Information Protection (E) are the core classification mechanism that lets you tag content containing PII so protection (encryption, marking, access restrictions) travels with the data across Microsoft 365 workloads. Microsoft Purview Data Loss Prevention (DLP) policies (D) automatically detect PII using sensitive information types and then block, warn, or audit risky sharing in Exchange Online, SharePoint, OneDrive, Teams, and endpoint locations. The Microsoft Purview Information Protection scanner (C) extends that same labeling and protection to on-premises file shares and SharePoint Server repositories, which is required for a complete PII detection and protection solution. Azure Policy (A) governs Azure resource compliance and cannot classify or protect PII in Microsoft 365 content, and Microsoft Defender for Cloud (B) is a cloud security posture and workload protection service, not a data classification or DLP tool for Microsoft 365 PII.

Answer

Azure Policy

Answer

Microsoft Defender for Cloud

Question 12

Refer to the exhibit. You are auditing an Azure subscription. The Azure Policy assignment above is targeting a resource group. The policy definition ID corresponds to a built-in policy that audits if SQL databases have transparent data encryption (TDE) enabled. What is the effect of this policy assignment?

Accepted Answer

The policy audits SQL databases for TDE and marks non-compliant resources.. Option D is correct because the built-in policy definition audits whether SQL databases have transparent data encryption (TDE) enabled, and an audit-effect policy evaluates resources and flags non-compliant ones in the compliance report without blocking or modifying them. Since the assignment targets a resource group, it evaluates the SQL databases within that scope and marks those lacking TDE as non-compliant. Option A is wrong because audit policies do not remediate or enable TDE; that would require a DeployIfNotExists or Modify effect. Option B is incorrect because 'audit' is the effect, not merely a reporting mode, and the policy still evaluates and flags resources. Option C is wrong because the assignment targets a resource group, not a management group, so its scope is limited to that resource group.

Answer

The policy automatically enables TDE on non-compliant SQL databases.

Answer

The policy is only reported as audit, not enforced.

Answer

The policy applies to all resources in the management group.

Question 13

Refer to the exhibit. You are investigating a security incident in Microsoft Sentinel. The KQL query above is used to identify potential brute-force attacks. What does the query return?

Accepted Answer

A list of user accounts and computers where the account has more than 5 failed logins in the last 24 hours.. The correct answer is C: a list of user accounts and computers where the account has more than 5 failed logins in the last 24 hours. This matches a typical Sentinel brute-force KQL pattern that filters SecurityEvent for EventID 4625 (failed logon), restricts the TimeGenerated window to the last 24 hours, and then summarizes failed attempts by Account and Computer, filtering with a threshold greater than 5. Option A is wrong because the grouping is by account and computer, not by computer alone, and it ignores the 24-hour time window. Option B is wrong because it omits the per-computer grouping, so it would not return computer context. Option D is wrong because it references successful logins rather than failed logons (EventID 4625).

Answer

A list of computers with more than 5 failed logins from any account.

Answer

A list of user accounts with more than 5 failed logins across all computers.

Answer

A list of user accounts with more than 5 successful logins in the last 24 hours.

Question 14

You are designing a solution to securely store and manage secrets for a cloud-native application deployed on Azure Kubernetes Service (AKS). The application needs to retrieve database connection strings and API keys at runtime without hardcoding them. The solution must minimize administrative overhead and integrate with Azure Active Directory (now Microsoft Entra ID) for access control. Which service should you use?

Accepted Answer

Azure Key Vault with managed identities. Azure Key Vault with managed identities (option C) is correct because it provides a fully managed, cloud-native secrets store that integrates natively with Microsoft Entra ID, and managed identities let the AKS pods authenticate to Key Vault without storing credentials, minimizing administrative overhead. The application can retrieve database connection strings and API keys at runtime via the Key Vault SDK or the Secrets Store CSI Driver, so nothing is hardcoded. Kubernetes Secrets (A) are only base64-encoded and stored in etcd, lack Entra ID-based access control, and require manual rotation and RBAC management. HashiCorp Vault on AKS (B) is powerful but self-managed, adding significant operational and administrative overhead. Azure App Configuration (D) is designed for application settings and feature flags, not for secure secret storage with Entra ID access control.

Answer

Kubernetes Secrets

Answer

HashiCorp Vault on AKS

Answer

Azure App Configuration

Question 15

Your organization is implementing Microsoft Defender for Cloud Apps to protect against malicious OAuth app permissions. Users have been granting permissions to third-party apps that request excessive scopes. What should you configure to automatically revoke such permissions?

Accepted Answer

OAuth app policies in Defender for Cloud Apps. The correct option is A, OAuth app policies in Defender for Cloud Apps. These policies are purpose-built to detect risky or over-privileged OAuth apps and can automatically revoke user-granted permissions or disable the app when it matches conditions such as excessive scopes or low community use. Intune app protection policies (B) govern mobile app data handling (MAM) and do not revoke OAuth consent grants. Conditional Access policies (C) control sign-in conditions and session access, not OAuth permission revocation. Microsoft Entra ID app permissions management (D) allows reviewing and revoking consent grants manually but does not provide the automated, risk-based revocation that Defender for Cloud Apps OAuth app policies deliver.

Answer

Microsoft Intune app protection policies

Answer

Conditional Access policies

Answer

Azure AD app permissions management