SC-100 Design security solutions for applications and data Practice Test 11 — 15 Questions

Question 1

You are designing a data security solution for a Microsoft 365 tenant that contains highly confidential files. You need to ensure that these files are encrypted and can only be accessed by authorized users, even if the files are downloaded and stored on a personal device. Which technology should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Purview Information Protection with encryption and usage rights. Microsoft Purview Information Protection with encryption and usage rights (option B) is correct because it applies persistent protection to the file itself via sensitivity labels, so the encryption and usage restrictions travel with the document even after it is downloaded to a personal device, and only authorized users with the granted rights can open it. Office 365 Message Encryption (A) only protects email messages in transit and does not persist on files stored locally. BitLocker (C) encrypts the whole drive at the OS level, so protection is lost once the file leaves that device. Azure Information Protection (D) is the legacy predecessor now superseded by Purview Information Protection, making B the current, appropriate choice.

Answer

Office 365 Message Encryption

Answer

BitLocker Drive Encryption

Answer

Azure Information Protection

Question 2

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to create an analytics rule that detects when a user account is created outside of business hours from an unusual IP address. Which type of rule should you use?

Accepted Answer

Scheduled query rule. The correct option is B, a Scheduled query rule, because this rule type lets you write a KQL query against your log data (e.g., SecurityEvent or AuditLogs) and schedule it to run at defined intervals, which is exactly what's needed to detect user account creation events filtered by time-of-day and unusual source IP conditions. Scheduled query rules support custom detection logic, entity mapping, and alert/incident generation, making them ideal for this scenario. Anomaly rules (A) are built-in templates that detect deviations from learned baselines and don't let you author arbitrary detection logic for specific conditions like account creation outside business hours. ML Behavior Analytics rules (C) are also prebuilt Microsoft-defined detections for specific behaviors, not customizable queries. Fusion rules (D) correlate multiple signals across products to detect multi-stage attacks and are not designed for a single custom condition like this.

Answer

Anomaly rule

Answer

ML Behavior Analytics rule

Answer

Fusion rule

Question 3

You are designing a solution to protect sensitive data in Azure Blob Storage. The data must be encrypted at rest using customer-managed keys (CMK) stored in Azure Key Vault. Additionally, you need to ensure that only specific virtual networks can access the storage account, and all access must be logged. Which three configurations should you implement? (Choose three.)

Accepted Answer

Enable Azure Storage logging for read and write requests. Option B is correct because the scenario explicitly requires encryption at rest with customer-managed keys (CMK) stored in Azure Key Vault, which is achieved by configuring the storage account to use CMK encryption referencing a Key Vault key. Option C is correct because restricting access to specific virtual networks requires configuring the storage account firewall (network rules) and enabling a virtual network service endpoint (Microsoft.Storage) on the designated subnets so traffic reaches the storage account over the Azure backbone. Option A is correct because the requirement that all access be logged is satisfied by enabling Azure Storage logging (diagnostic logging for read and write requests) for the blob service, capturing authentication and access details. Option D is incorrect because Azure Files encryption at rest is unrelated to Blob Storage and does not address CMK, network restriction, or logging for blobs. Option E is incorrect because soft delete for blobs is a data-protection/recovery feature that retains deleted blobs; it does not provide encryption with CMK, network access control, or access logging.

Answer

Enable Azure Files encryption at rest

Answer

Enable soft delete for blobs

Question 4

Your organization is using Microsoft Defender for Cloud to assess the security posture of your Azure resources. You need to ensure that all storage accounts have secure transfer required enabled. Which Defender for Cloud feature should you use?

Accepted Answer

Security policies and initiatives. Security policies and initiatives in Microsoft Defender for Cloud are the correct choice because they let you define and assign Azure Policy definitions—such as the built-in 'Secure transfer to storage accounts should be enabled' policy—that continuously assess storage accounts and flag any that lack Secure transfer required (HTTPS-only). This directly addresses the requirement to ensure all storage accounts have secure transfer enabled. File integrity monitoring is incorrect because it tracks changes to OS files and registry keys on VMs, not storage account configuration. Adaptive network hardening is incorrect because it generates NSG rules based on traffic analysis, and Just-In-Time VM access is incorrect because it restricts inbound VM ports on demand—neither evaluates storage account encryption-in-transit settings.

Answer

File integrity monitoring

Answer

Adaptive network hardening

Answer

Just-In-Time VM access

Question 5

You are designing a data classification strategy for a Microsoft 365 tenant. You need to automatically classify documents that contain personally identifiable information (PII) and apply a retention label. Which Microsoft Purview feature should you use?

Accepted Answer

Auto-labeling policies. Auto-labeling policies (option A) are the correct choice because they can automatically apply sensitivity or retention labels to documents in Microsoft 365 services such as SharePoint, OneDrive, and Exchange when content matches specified conditions, including sensitive information types like PII. They are designed specifically for automatic classification and labeling at scale, which matches the requirement to classify PII-containing documents and apply a retention label. Trainable classifiers (option B) can identify content based on examples, but they are used to detect custom content types and still require a labeling policy to apply labels, so they are not the primary feature for this scenario. Manual labeling (option C) requires user intervention and does not meet the need for automatic classification. DLP policies (option D) can detect and protect sensitive information, but they do not apply retention labels; they enforce actions like blocking or notifying.

Answer

Trainable classifiers

Answer

Manual labeling

Answer

Data Loss Prevention (DLP) policies

Question 6

Your company uses Microsoft Azure to host a critical application that processes credit card payments. The application must comply with PCI DSS. You need to ensure that all access to cardholder data is logged and monitored, and that any unauthorized access attempts trigger an alert. Which combination of services should you use?

Accepted Answer

Azure Monitor and Microsoft Sentinel. Azure Monitor and Microsoft Sentinel (option D) are the right combination because Azure Monitor collects and retains the logs and metrics from the application and its Azure resources, while Microsoft Sentinel ingests those logs to correlate events, detect unauthorized access attempts to cardholder data, and generate alerts via analytics rules and incident creation, satisfying PCI DSS logging and monitoring requirements. Azure Monitor provides the telemetry pipeline (Log Analytics workspace, diagnostic settings) and Sentinel adds SIEM/SOAR detection and alerting on top of it. Option A is wrong because Azure Policy enforces configuration compliance and Defender for Cloud Apps is a CASB for SaaS discovery/control, not a log-monitoring and alerting SIEM. Option B is wrong because Azure Policy and Defender for Cloud provide posture management and threat protection but do not deliver the centralized log correlation and custom alerting on access to cardholder data that Sentinel does. Option C is wrong because Azure Key Vault only manages secrets, keys, and certificates, and Defender for Cloud alone does not provide the required log aggregation and alerting.

Answer

Azure Policy and Microsoft Defender for Cloud Apps

Answer

Azure Policy and Microsoft Defender for Cloud

Answer

Azure Key Vault and Microsoft Defender for Cloud

Question 7

A company is designing a secure API for a customer-facing application that will handle sensitive personal data. They need to ensure that only authorized client applications can call the API and that the identity of the end-user is verified. Which of the following should they implement?

Accepted Answer

OAuth 2.0 with client credentials and OpenID Connect. OAuth 2.0 with client credentials authenticates the client application, while OpenID Connect (OIDC) adds an identity layer to verify the end-user's identity via ID tokens. This combination ensures both client authorization and user authentication, which are the two requirements. OAuth 2.0 alone handles authorization, and OIDC extends it for authentication.

Answer

HTTP Basic Authentication

Answer

JWT bearer tokens

Answer

API keys

Question 8

You are designing a solution for a healthcare organization that needs to share patient health information (PHI) with a partner organization. The partner must be able to query the data but should not be able to modify it. Both organizations use Microsoft Entra ID. What should you use?

Accepted Answer

Microsoft Entra entitlement management with an access package that grants read-only access to a SharePoint Online site.. The correct option is B: Microsoft Entra entitlement management with an access package that grants read-only access to a SharePoint Online site. Entitlement management is designed for B2B collaboration, allowing external partner users from another Entra ID tenant to request and receive governed access to resources, and an access package can assign a read-only permission level (e.g., SharePoint Visitors/Read) so the partner can query but not modify PHI. Option A is wrong because Entra ID B2C is for customer-facing identity scenarios, not partner B2B collaboration, and a custom API would require you to build and enforce read-only authorization yourself. Option C is wrong because Purview Information Protection labels and encrypts data but does not provide the partner query access or enforce read-only permissions. Option D is wrong because Azure DevOps repositories are for source code, not for sharing PHI with a partner organization.

Answer

Azure Active Directory B2C (now part of Entra) to allow the partner to authenticate and access data via a custom API.

Answer

Microsoft Purview Information Protection to label the data and allow the partner to decrypt it.

Answer

Azure DevOps for sharing the data in a repository with read-only permissions.

Question 9

Your organization is using Microsoft Defender for Cloud to secure applications running on Azure. You need to ensure that all Azure Storage accounts have secure transfer required enabled. What is the BEST way to enforce this?

Accepted Answer

Assign an Azure Policy initiative that includes the built-in policy 'Secure transfer to storage accounts should be enabled' with a 'Deny' effect.. The best way to enforce that all Azure Storage accounts have secure transfer required enabled is to assign an Azure Policy initiative that includes the built-in policy 'Secure transfer to storage accounts should be enabled' with a 'Deny' effect (option C). Azure Policy is the native governance service that evaluates resource properties and can block non-compliant deployments, so a Deny effect prevents creation or modification of storage accounts that do not have secure transfer required enabled. A custom recommendation in Defender for Cloud (option A) only provides visibility and alerts; it does not enforce the setting. Azure Blueprints (option B) can orchestrate policy assignments but is not itself the enforcement mechanism, and it is being deprecated in favor of template specs and deployment stacks. Granting the Storage Account Contributor role (option D) relies on manual action and does not guarantee enforcement.

Answer

Create a custom recommendation in Microsoft Defender for Cloud to alert when storage accounts do not have secure transfer required.

Answer

Use Azure Blueprints to apply the setting to all subscriptions.

Answer

Grant the 'Storage Account Contributor' role to a security group that will manually enable the setting.

Question 10

Your organization uses Microsoft 365 and wants to prevent users from sharing sensitive documents externally via email. The solution must be able to detect credit card numbers and automatically block the email. Which technology should you use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online. Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online is the correct choice because DLP is purpose-built to inspect email content in transit and detect sensitive information types such as credit card numbers, then automatically block or restrict the message per policy actions. It natively integrates with Exchange Online so detection and blocking happen at the mail-flow level without user intervention. Sensitivity labels with auto-classification apply classification and protection to content but do not themselves block an email from being sent externally based on credit card detection. Safe Attachments focuses on malware detonation in attachments, not on detecting sensitive data patterns, and the AIP unified labeling client is a client-side labeling tool rather than a server-side email blocking control.

Answer

Microsoft Purview Sensitivity labels with auto-classification

Answer

Microsoft Defender for Office 365 Safe Attachments

Answer

Azure Information Protection (AIP) unified labeling client

Question 11

A company is deploying a new application that uses Azure Cosmos DB. The security requirements include: data encryption at rest, data encryption in transit, and the ability to audit all data access. Which THREE of the following should you implement?

Accepted Answer

Require TLS for all connections to Cosmos DB. Option B is correct because requiring TLS for all Cosmos DB connections enforces data encryption in transit, protecting data as it moves between clients and the service. Option D is correct because enabling encryption at rest with customer-managed keys ensures stored data is encrypted and gives the organization control over the key lifecycle, satisfying the encryption-at-rest requirement. Option E is correct because enabling diagnostic logging for Cosmos DB captures data-plane and control-plane operations, providing the audit trail needed to monitor and audit all data access. Option A is incorrect because replacing Cosmos DB with Azure SQL Database does not meet the stated application requirement to use Cosmos DB and does not by itself address all three security controls. Option C is incorrect because Microsoft Entra ID authentication addresses identity and access control, not encryption at rest, encryption in transit, or auditing of data access.

Answer

Use Azure SQL Database instead of Cosmos DB

Answer

Use Azure Active Directory authentication for Cosmos DB

Question 12

Refer to the exhibit. What is the effect of this Azure Policy definition?

Accepted Answer

It denies creation or update of storage accounts that do not enforce HTTPS traffic.. The correct option is B: it denies creation or update of storage accounts that do not enforce HTTPS traffic. An Azure Policy definition with a deny effect targeting the Microsoft.Storage/storageAccounts resource type and the supportsHttpsTrafficOnly property blocks any create or update request where that property is false or missing, enforcing secure transfer. Option A is wrong because the policy targets storage accounts, not virtual networks, and HTTPS enforcement is not a virtual network property. Option C is wrong because the effect is deny, not audit, so noncompliant requests are blocked rather than merely logged. Option D is wrong because the policy scope is the storage account resource itself, not the blob service child resource.

Answer

It denies creation of virtual networks that are not using HTTPS.

Answer

It audits storage accounts to check if HTTPS traffic is enforced.

Answer

It denies creation of blob services that do not enforce HTTPS.

Question 13

Refer to the exhibit. A security administrator needs to ensure that the storage account 'securestore' is compliant with the company policy that requires encryption at rest using customer-managed keys and network access restricted to a specific virtual network. Which of the following statements is correct?

Accepted Answer

The storage account is compliant because it uses customer-managed keys from Key Vault and network access is restricted to a specific virtual network.. Option C is correct because it states that the storage account uses customer-managed keys from Key Vault for encryption at rest and restricts network access to a specific virtual network, which exactly matches the company policy requirements. Customer-managed keys stored in Azure Key Vault satisfy the encryption-at-rest requirement, and a virtual network rule or service endpoint scoped to one VNet satisfies the network restriction. Option A is wrong because enabling encryption for blob and file services does not by itself address the customer-managed key or network restriction requirements. Option B is wrong because it assumes Microsoft-managed keys, which contradicts the scenario where customer-managed keys are used. Option D is wrong because it claims network access is open to any virtual network, which is not the case when access is restricted to a specific VNet.

Answer

The storage account is compliant only if encryption is enabled for blob and file services.

Answer

The storage account is non-compliant because it uses Microsoft-managed keys for encryption.

Answer

The storage account is non-compliant because network access is allowed from any virtual network.

Question 14

Your organization is deploying a customer-facing web application in Azure. The application must authenticate users via Microsoft Entra ID and access Microsoft Graph to read user profiles. The security team requires that the application never has access to user passwords. Which authentication flow should you recommend?

Accepted Answer

OAuth 2.0 authorization code flow with PKCE. The correct option is D, OAuth 2.0 authorization code flow with PKCE, because it is the recommended flow for customer-facing web applications that authenticate users interactively via Microsoft Entra ID and call Microsoft Graph on their behalf. With PKCE, the client proves possession of a one-time code verifier, and the user authenticates directly against Entra ID, so the application never handles or sees user passwords. The resulting delegated access token also allows reading user profiles through Microsoft Graph with the appropriate scopes. Option A (implicit grant) is deprecated and exposes tokens in the browser URL fragment, while option B (device authorization flow) is intended for input-constrained devices and is not suited to a normal web app. Option C (client credentials grant) is app-only authentication with no user context, so it cannot authenticate users or read their profiles as required.

Answer

OAuth 2.0 implicit grant flow

Answer

OAuth 2.0 device authorization flow

Answer

OAuth 2.0 client credentials grant flow

Question 15

Your company uses Microsoft Defender for Cloud Apps to discover shadow IT. You need to ensure that data exfiltration from sanctioned cloud apps is blocked in real-time. Which control should you configure?

Accepted Answer

Conditional Access App Control. Conditional Access App Control is the correct answer because it enables real-time session monitoring and control over sanctioned cloud apps, allowing you to block data exfiltration actions such as downloads, copy/paste, and uploads via reverse proxy integration with Microsoft Entra Conditional Access. It is specifically designed for inline enforcement on user sessions, which matches the requirement to block exfiltration in real time. IP address ranges are used for defining corporate network boundaries in Cloud Discovery, not for session-level blocking. Cloud discovery only identifies shadow IT usage from logs and does not enforce real-time controls. App connectors provide API-based visibility and governance for sanctioned apps but do not block user actions in real time.

Answer

IP address ranges

Answer

Cloud discovery

Answer

App connector