SC-100 Design security solutions for applications and data Practice Test 11 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to protect its Azure workloads. You have an application that runs on Azure Virtual Machines and uses a storage account to store sensitive data. The security team wants to detect when the storage account access keys are used from an unexpected location. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Microsoft Defender for Storage and configure anomaly detection alerts.. Microsoft Defender for Cloud provides adaptive application controls, file integrity monitoring, and just-in-time access, but not specifically for detecting storage key usage from unexpected locations. Microsoft Defender for Storage (part of Defender for Cloud) provides anomaly detection, including unusual access patterns. You can also use Azure Monitor with alerts on storage metrics, but the most direct is Defender for Storage. Option D is correct.

Answer

Configure adaptive application controls on the storage account.

Answer

Create an Azure Monitor alert based on the 'Storage Account List Keys' operation.

Answer

Enable just-in-time VM access in Microsoft Defender for Cloud.

Question 2

A company is designing a microservices architecture on Azure Kubernetes Service (AKS). Each microservice needs to authenticate to Azure SQL Database using its own identity. The security team requires that no service principal secrets or certificates be stored in the cluster. What should you implement to authenticate the microservices to Azure SQL Database?

Accepted Answer

Use Azure AD Workload Identity for each pod to authenticate to Azure SQL Database using managed identities.. Azure AD Workload Identity allows each pod to assume a specific managed identity, eliminating the need for secrets or certificates. This integrates with Azure SQL's Azure AD authentication, meeting the requirement. Option A still uses a service principal secret (stored in Key Vault), violating the no-secrets policy. Option B uses a node-level managed identity, which is too broad and doesn't isolate per microservice. Option D stores credentials directly in a Kubernetes secret, which is prohibited.

Answer

Create a service principal and store its secret in Azure Key Vault; use the Key Vault Secrets Store CSI driver to mount it.

Answer

Enable a system-assigned managed identity on the AKS cluster nodes and have pods use it.

Answer

Store the Azure SQL connection string with credentials in a Kubernetes secret.

Question 3

Your organization uses Microsoft Purview to classify and protect sensitive data. You need to prevent users from accidentally sharing files that contain credit card numbers via email. What should you configure in Microsoft Purview?

Accepted Answer

Implement a data loss prevention (DLP) policy that detects credit card numbers and blocks email sharing.. Data Loss Prevention (DLP) policies in Microsoft Purview can detect sensitive information types like credit card numbers and block sharing via email. Sensitivity labels can be applied automatically but do not block sharing by themselves. The correct answer is DLP policy.

Answer

Enable Microsoft Defender for Cloud Apps session policy to monitor file downloads.

Answer

Configure a retention policy for files containing credit card numbers.

Answer

Create a sensitivity label that automatically classifies credit card numbers.

Question 4

You are designing a solution to protect an Azure App Service web app that authenticates users via Microsoft Entra ID. The app needs to ensure that only users from specific external partner organizations can access it. You do not want to create user objects for each partner user in your tenant. What should you configure?

Accepted Answer

Enable Microsoft Entra B2B collaboration and configure the application to accept tokens from partner tenants.. B2B collaboration allows external users from partner organizations to access applications using their own identities, without needing separate user objects in your tenant. The application can be configured to accept tokens issued by partner tenants, enabling access only from specified external organizations. B2C is designed for customer-facing applications, not partner access. Conditional Access policies can restrict access based on IP ranges but do not solve the requirement of using partner identities without user objects. Creating guest user accounts for each external user would require user objects, which contradicts the requirement.

Answer

Configure a Conditional Access policy that restricts access to partners' IP ranges.

Answer

Create guest user accounts for each external user and assign them to a group.

Answer

Use Azure AD B2C custom policies to allow partner authentication.

Question 5

Your organization uses Microsoft Sentinel as its SIEM. You need to collect logs from a custom line-of-business application that does not support standard syslog or Windows Event Log. The application writes logs to a text file on a Windows server. What is the most efficient way to ingest these logs into Microsoft Sentinel?

Accepted Answer

Install the Log Analytics Agent (deprecated, but still available) on the server and configure custom log collection.. The Log Analytics Agent (formerly Microsoft Monitoring Agent) can be configured to collect custom text logs by specifying the log file path and a custom parsing rule. This is the most direct and efficient method because it reads the text file directly from the server with minimal overhead.

- Option A is incorrect because syslog is not supported by Windows natively and requires additional infrastructure; the application would need to be modified to output syslog, which is inefficient.
- Option B is incorrect because using Event Hubs adds complexity and cost; the application would need to write to Event Hubs, requiring code changes.
- Option C is incorrect because the Azure Monitor Agent does not natively support collecting custom text logs; it is designed for structured data sources like performance counters and Windows events.

Answer

Configure the application to send logs to a syslog server and use a syslog connector.

Answer

Set up a Azure Event Hubs and have the application write logs to Event Hubs.

Answer

Use the Azure Monitor Agent to collect the text file via a custom data source.

Question 6

A company is designing a secure data sharing solution with a partner organization. The data will be stored in Azure Blob Storage. Requirements include: encryption at rest with customer-managed keys, granular access control to specific blobs, and the ability to expire access automatically. Which TWO solutions should you combine? (Choose two.)

Accepted Answer

Generate shared access signatures (SAS) with specific permissions and expiry times.. (Shared Access Signatures) provides granular, time-limited access to specific blobs, meeting the requirements for granular access control and automatic expiry. Option E (Azure Storage Service Encryption with customer-managed keys) ensures encryption at rest with customer-managed keys. Together, A and E satisfy all stated requirements. Option B (Azure AD authentication) provides identity-based access but does not inherently support automatic expiry. Option C (firewall) restricts network access but does not address blob-level authorization or encryption. Option D (Azure RBAC) provides container-level access, which is less granular than SAS.

Answer

Enable Azure Active Directory authentication for the storage account.

Answer

Configure a firewall on the storage account to allow only partner IP addresses.

Answer

Use Azure RBAC to assign the Storage Blob Data Reader role to partner users.

Question 7

A company is deploying a new API management solution using Azure API Management. The APIs will be consumed by external partners. Security requirements include: protecting against OWASP Top 10 attacks, throttling requests per subscription, and validating JSON schemas. Which TWO policies should you configure? (Choose two.)

Accepted Answer

Validate content policy to check JSON schema.. Azure API Management policies can be added to protect APIs. The 'Validate content' policy can validate JSON schemas, addressing the requirement to validate JSON schemas. The 'Rate limit' policy throttles requests per subscription, meeting the throttling requirement. The 'Validate JWT' policy is for token validation, not directly for OWASP top 10 protection or the specified requirements. The 'IP filter' policy restricts by IP, which is not requested. The 'Cross domain' policy is for CORS, not relevant. Thus, Options A and B are correct.

Answer

Validate JWT policy to ensure tokens are valid.

Answer

IP filter policy to restrict access to partner IPs.

Answer

Cross domain policy to allow CORS.

Question 8

A large financial services company is migrating its customer-facing web application to Azure. The application handles sensitive personal data and must comply with PCI DSS. The solution will use Azure App Service (Linux) with a custom container, Azure SQL Database, and Azure Redis Cache. The security architect mandates that all data in transit be encrypted using the latest TLS version, and that the application must be protected against common web vulnerabilities. The company also wants to ensure that only authenticated users can access the Redis cache. Users will authenticate via Microsoft Entra ID. The operations team needs to be able to monitor for SQL injection attempts and anomalous access patterns. You need to design the security configuration. Which of the following is the most comprehensive approach that meets all requirements?

Accepted Answer

Configure App Service to enforce TLS 1.2 as minimum. Deploy Azure Application Gateway with WAF enabled in front of App Service. Enable Azure AD authentication for Azure Redis Cache. Enable Microsoft Defender for SQL for Azure SQL Database.. Azure App Service enforces TLS 1.2/1.3 by default. Azure WAF (Web Application Firewall) in front of App Service protects against OWASP Top 10. Azure AD authentication for Redis Cache is supported via Azure AD RBAC for Redis (currently in preview but available). Microsoft Defender for SQL detects SQL injection and anomalous access. Option A covers all requirements. Option B uses Application Gateway without WAF. Option C uses Redis firewall which doesn't enforce authentication. Option D uses Azure Front Door without WAF.

Answer

Use Azure Front Door with custom domain and enforce TLS 1.2. Configure IP firewall on Redis Cache. Use Azure SQL Database with VNet service endpoints.

Answer

Deploy App Service with HTTPS only enabled. Use Azure API Management with WAF. Use Redis Cache with access keys. Enable SQL audit logging.

Answer

Enable TLS 1.3 on App Service. Use Azure CDN with WAF. Configure Redis Cache with a firewall rule allowing only App Service outbound IPs.

Question 9

A company uses Microsoft Defender for Cloud Apps to protect SaaS applications. The security team receives alerts about suspicious file downloads from a specific user. They want to automatically block the user's account when the risk score exceeds 80. What should they configure?

Accepted Answer

Create an access policy. An access policy in Microsoft Defender for Cloud Apps can automatically block a user based on the risk score exceeding a threshold. Option A is wrong because Conditional Access app control is a feature that enforces session-level controls, not direct blocking based on risk. Option B is wrong because session policies allow real-time monitoring and control of user sessions but do not directly block accounts. Option D is wrong because app governance policies manage app permissions and consent, not user blocking.

Answer

Configure Conditional Access app control

Answer

Create a session policy

Answer

Create an app governance policy

Question 10

You are designing a secure data classification strategy for documents in Microsoft 365. The compliance officer wants to automatically apply a 'Confidential' label to documents containing credit card numbers. Which Microsoft Purview feature should you use?

Accepted Answer

Auto-labeling policies. Auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels to documents and emails based on sensitive info types, such as credit card numbers. This is the correct feature for automatically applying the 'Confidential' label when credit card numbers are detected. Data loss prevention policies prevent sharing of sensitive data but do not apply labels. Trainable classifiers are used for more complex pattern recognition and require training data, not for predefined sensitive info types. Manual labeling requires user intervention, which does not meet the automatic requirement.

Answer

Data loss prevention policies

Answer

Trainable classifiers

Answer

Manual labeling

Question 11

Refer to the exhibit. You are evaluating a custom Azure Policy definition for storage accounts. The policy is assigned with effect set to 'Deny'. An administrator attempts to create a new storage account with network rules configured to allow all traffic (defaultAction set to Allow). What will happen?

Accepted Answer

The storage account creation is denied.. The custom Azure Policy definition with effect set to 'Deny' will evaluate the storage account creation request against the policy rule. Since the storage account's network rules have defaultAction set to 'Allow' (which does not comply with the policy requirement that defaultAction must be 'Deny'), the policy denies the creation request. Therefore, Option A is correct. Option B is incorrect because the policy does not modify the resource; it denies the operation outright. Option C is incorrect because the effect is 'Deny', not 'Audit', so no audit event is generated. Option D is incorrect because the policy explicitly denies non-compliant resources.

Answer

The storage account is created, and the network rules are automatically changed to deny all traffic.

Answer

The storage account is created, and an audit event is generated.

Answer

The storage account is created successfully, and no action is taken.

Question 12

A retail company uses Microsoft Defender for APIs to protect its online store API. The security team notices unusual API calls from an IP address that is not in the allowed list. They want to block this IP address for 24 hours. What should they configure?

Accepted Answer

Update the API collection. Updating the API collection (Option C) in Microsoft Defender for APIs allows you to apply a security policy, such as IP restrictions, to the API collection. This enables blocking a specific IP address for a defined period. Option D (rate-limiting rule) is not a feature of Defender for APIs; rate-limiting is handled by Azure API Management policies, not directly by Defender for APIs. Option A (API schema validation) validates request formats, not IP addresses. Option B (authentication settings) controls token verification, not IP blocking.

Answer

Configure API schema validation

Answer

Modify the authentication settings

Answer

Create a rate-limiting rule

Question 13

You are designing a secure CI/CD pipeline for a web application deployed to Azure Kubernetes Service (AKS). The security team requires that container images are scanned for vulnerabilities before deployment. Which two services should you integrate?

Accepted Answer

Microsoft Defender for Containers and Azure Container Registry. Microsoft Defender for Containers integrates with ACR to scan images. Option A is wrong because Azure Policy can enforce rules but does not scan images. Option B is wrong because Azure DevOps does not scan images natively. Option D is wrong because Azure Key Vault stores secrets.

Answer

Azure DevOps and Azure Key Vault

Answer

Azure Policy and Azure DevOps

Answer

Azure Key Vault and Azure Container Registry

Question 14

A company uses Microsoft Sentinel to detect threats. They want to automatically send an email to the security team when a high-severity incident is created. What should they configure?

Accepted Answer

An analytics rule with an automated response. Analytics rules in Microsoft Sentinel can include automated responses that trigger playbooks, such as sending an email via a connector like Office 365 Outlook. Option B is incorrect because workbooks are used for visualization and reporting, not for automated actions. Option C is incorrect because watchlists are collections of reference data for correlation, not for triggering responses. Option D is incorrect because hunting queries are used for proactive threat hunting, not for automated incident response.

Answer

A workbook

Answer

A watchlist

Answer

A hunting query

Question 15

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Exchange Online. The compliance team wants to prevent users from sending emails containing Social Security numbers to external recipients. What should you configure?

Accepted Answer

Create a DLP policy with the condition 'Content contains sensitive info type' and action 'Block the message'. A DLP policy can detect sensitive info types and block the email. Option B is wrong because retention labels are for data retention, not blocking. Option C is wrong because mail flow rules (transport rules) can do similar but DLP is the recommended approach. Option D is wrong because sensitivity labels are for classification, not blocking.

Answer

Configure a retention label for emails

Answer

Create a mail flow rule in Exchange admin center

Answer

Apply a sensitivity label to all emails