SC-100 Design security solutions for applications and data Practice Test 11 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage devices. You need to deploy a line-of-business (LOB) app to iOS devices that is not available in the public App Store. The app is signed with an enterprise certificate. Which app deployment method should you use?

Accepted Answer

iOS line-of-business app deployment in Intune. Option D is correct because Intune can deploy LOB apps to iOS devices using enterprise certificate signing and MDM distribution. Option A is wrong because the VPP store only contains public apps. Option B is wrong because Android Enterprise is not for iOS. Option C is wrong because Microsoft Store for Business is for Windows apps.

Answer

Android Enterprise managed Google Play

Answer

Volume Purchase Program (VPP) token

Answer

Microsoft Store for Business

Question 2

Your company uses Microsoft Sentinel for security operations. You need to design a solution that automatically remediates a detected threat by blocking a malicious IP address on Azure Firewall. Which Microsoft Sentinel feature should you use?

Accepted Answer

SOAR playbooks. Option C is correct because Security Orchestration, Automation, and Response (SOAR) in Microsoft Sentinel uses playbooks to automate remediation actions like blocking IPs on Azure Firewall. Option A is wrong because analytics rules only generate alerts. Option B is wrong because workbooks visualize data. Option D is wrong because UEBA analyzes behavior but does not automate remediation.

Answer

Analytics rules

Answer

Workbooks

Answer

User and Entity Behavior Analytics (UEBA)

Question 3

Your organization uses Microsoft Defender for Cloud to secure multi-cloud workloads. You need to ensure that Azure, AWS, and GCP resources are assessed against a common set of security standards. Which capability should you use?

Accepted Answer

Regulatory compliance standards. Option A is correct because regulatory compliance standards in Defender for Cloud can be applied across Azure, AWS, and GCP to enforce common benchmarks. Option B is wrong because JIT is only for Azure VMs. Option C is wrong because vulnerability assessments are per-resource type. Option D is wrong because CNAPP is a broader framework, not a specific compliance standard.

Answer

Vulnerability assessment solutions

Answer

Cloud Security Posture Management (CSPM)

Answer

Just-in-time (JIT) VM access

Question 4

Your application uses Azure Key Vault to store secrets. You need to ensure that the application rotates secrets automatically without downtime. Which feature should you enable?

Accepted Answer

Key Vault automatic rotation with Event Grid integration. Option B is correct because Key Vault automatic rotation with Event Grid notifications allows the application to be notified before expiration and rotate seamlessly. Option A is wrong because manual rotation requires intervention. Option C is wrong because soft-delete only protects against accidental deletion. Option D is wrong because RBAC controls access, not rotation.

Answer

Key Vault manual rotation

Answer

Key Vault soft-delete

Answer

Key Vault RBAC

Question 5

Your company uses Microsoft Entra ID for identity management. You need to implement a solution that allows external partners to access a specific application using their own identity providers, while ensuring that their accounts are automatically deprovisioned when removed from their home organization. Which feature should you use?

Accepted Answer

Entitlement management with connected organizations. Option C is correct because Entitlement management with connected organizations allows external users to be provisioned and deprovisioned automatically based on lifecycle. Option A is wrong because B2B direct federation does not enforce deprovisioning. Option B is wrong because self-service sign-up does not manage deprovisioning. Option D is wrong because Identity Governance includes access reviews but does not automatically deprovision.

Answer

B2B direct federation

Answer

Self-service sign-up

Answer

Identity Governance access reviews

Question 6

Your organization uses Microsoft Purview to map and classify data across Azure, on-premises, and multi-cloud sources. You need to ensure that sensitive data assets are automatically discovered and classified. Which Microsoft Purview component should you configure?

Accepted Answer

Data Map scanning. Option A is correct because Microsoft Purview Data Map scans and classifies data across sources. Option B is wrong because Data Catalog is the inventory, not scanning. Option C is wrong because Data Sharing is for sharing data. Option D is wrong because Data Estate Insights provides monitoring, not scanning.

Answer

Data Sharing

Answer

Data Catalog

Answer

Data Estate Insights

Question 7

Your company uses Microsoft Defender for Cloud Apps to protect its SaaS environment. You need to configure settings to detect and block risky user activities. Which TWO actions should you take? (Choose TWO.)

Accepted Answer

Configure anomaly detection policies.. Option B and Option D are correct. Enabling session monitoring allows real-time activity monitoring, and configuring anomaly detection policies helps detect risky behaviors. Option A is incorrect because blocking all third-party apps is too restrictive. Option C is incorrect because app discovery policies discover shadow IT, not detect risky user activities. Option E is incorrect because IP address ranges are for location-based policies, not core detection.

Answer

Block all third-party app access.

Answer

Define IP address ranges for trusted locations.

Answer

Configure app discovery policies.

Question 8

Your organization is deploying a new application on Azure Kubernetes Service (AKS). You need to secure container access to Azure resources using managed identities. Which THREE components are required? (Choose THREE.)

Accepted Answer

Pod identity (e.g., aad-pod-identity). Option A, Option B, and Option D are correct. A pod identity is needed to assign an identity to pods, Azure Key Vault stores secrets, and Azure AD pod-managed identity (or workload identity) provides the identity. Option C is incorrect because Azure Container Registry is for storing images, not identity. Option E is incorrect because Azure Firewall is for network security.

Answer

Azure Container Registry

Answer

Azure Firewall

Question 9

Your company uses Microsoft Intune to manage corporate devices. You need to protect company data on devices by preventing data leakage to personal apps. Which TWO policies should you configure? (Choose TWO.)

Accepted Answer

App protection policies (MAM). Option A and Option D are correct. App protection policies (MAM) can prevent data transfer to unmanaged apps, and conditional access can restrict access to managed apps. Option B is incorrect because device compliance policies focus on device health, not data leakage. Option C is incorrect because Windows Information Protection (WIP) is for Windows devices, not cross-platform. Option E is incorrect because configuration profiles set device settings, not data protection.

Answer

Device compliance policies

Answer

Device configuration profiles

Answer

Windows Information Protection (WIP)

Question 10

Refer to the exhibit. You are designing an API Management instance for a production environment. The exhibit shows a snippet of an ARM template. Which security concern is most critical to address before deploying to production?

Accepted Answer

The SKU is set to Developer, which is not suitable for production.. Option D is correct because the Developer SKU is not suitable for production due to lack of SLA and limited scale. Option A is wrong because disabling TLS 1.0/1.1 and weak ciphers is actually a security best practice. Option B is wrong because the publisher email and name are informational. Option C is wrong because the API version constraint affects feature set, not security.

Answer

Weak TLS cipher suites are enabled.

Answer

Publisher email and name are hardcoded.

Answer

The API version constraint is outdated.

Question 11

Refer to the exhibit. You run the PowerShell script to protect high-confidentiality resources. After execution, you find that some resources with tag 'Confidentiality=High' are still unprotected. What is the most likely reason?

Accepted Answer

Some resources are in a different resource group than expected.. Option B is correct because the script uses Get-AzResource which returns resources from all resource groups, but the lock creation uses -ResourceGroupName parameter. If a resource is in a different resource group than the one resolved from the resource object, the lock might fail or apply incorrectly. Option A is wrong because the script does not check for existing locks correctly, but the main issue is the resource group mismatch. Option C is wrong because the script checks for locks before creating new ones. Option D is wrong because tag inheritance is not the issue.

Answer

The script does not check for existing locks properly.

Answer

Tags are not inherited from resource groups.

Answer

The script overwrites existing locks.

Question 12

Your organization, Contoso Ltd., is a multinational company with 50,000 employees. They use Microsoft 365 E5, Azure, and Microsoft Sentinel. The security team wants to implement a data security solution that meets the following requirements:

1. All sensitive data stored in SharePoint Online and OneDrive for Business must be automatically classified and protected using sensitivity labels.
2. When a user attempts to share a file labeled 'Highly Confidential' with an external user, the action should be blocked and an alert sent to the security team.
3. The solution must detect and prevent data exfiltration from endpoints by monitoring copy/paste and print actions on sensitive data.
4. All data security events must be centralized in Microsoft Sentinel for correlation and investigation.
5. The solution must comply with regulatory requirements that mandate data retention and eDiscovery capabilities.

You need to design the data security solution. Which combination of Microsoft security components should you use?

Accepted Answer

Microsoft Purview Information Protection, Microsoft Purview DLP, and Microsoft Purview eDiscovery. Option D is correct. Microsoft Purview Information Protection auto-labeling policies meet requirement 1. DLP policies in Purview block sharing and alert (requirement 2). Endpoint DLP in Purview monitors copy/paste/print (requirement 3). Purview audit logs are ingested into Microsoft Sentinel (requirement 4). Microsoft Purview eDiscovery and retention policies meet requirement 5. Option A is wrong because Microsoft Defender for Cloud Apps does not provide endpoint DLP or eDiscovery. Option B is wrong because Microsoft Intune does not provide DLP or eDiscovery. Option C is wrong because Microsoft Defender for Endpoint focuses on endpoint protection, not data classification or eDiscovery.

Answer

Microsoft Intune and Microsoft Entra ID

Answer

Microsoft Defender for Endpoint and Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps and Microsoft Entra ID

Question 13

Your organization uses Microsoft Entra ID and plans to implement a custom line-of-business application that accesses Microsoft Graph APIs. The application will be used by employees and external partners. You need to ensure that the application can authenticate users and obtain appropriate permissions without exposing the client secret. What should you implement?

Accepted Answer

Implement OAuth 2.0 authorization code flow with PKCE.. Managed identities are not suitable for client applications that run outside Azure. Using certificates instead of client secrets enhances security but still requires secret management. OAuth 2.0 authorization code flow with PKCE is the recommended approach for mobile and desktop apps, but for a web app with a backend, the best practice is to use a system-assigned managed identity if hosted in Azure, or use certificates/Key Vault. However, the question specifies a custom LOB app used by employees and external partners, likely hosted on-premises or in Azure. The most secure approach for a confidential client is to use a certificate stored in Azure Key Vault. But the correct answer here is to implement OAuth 2.0 authorization code flow with PKCE (Proof Key for Code Exchange) to avoid exposing the client secret in the browser. For a web app with a backend, using the authorization code flow with PKCE is still recommended, and the client secret is not exposed. Option D is the most accurate.

Answer

Use a system-assigned managed identity to authenticate to Microsoft Graph.

Answer

Store the client secret in Azure Key Vault and retrieve it at runtime.

Answer

Register the application as a public client and use the implicit grant flow.

Question 14

A company is deploying a new application that will store sensitive customer data in Azure SQL Database. The security team requires that all data at rest be encrypted using a customer-managed key stored in Azure Key Vault. Additionally, they need to ensure that the database can be restored to a point in time and that the encryption key is rotated every 90 days. Which combination of features should you configure?

Accepted Answer

Enable TDE with customer-managed keys in Azure Key Vault and configure automatic key rotation.. Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault meets the encryption requirement. Automatic key rotation via Key Vault ensures rotation every 90 days. Point-in-time restore (PITR) is built into Azure SQL. Always Encrypted is column-level and not required. Option A correctly combines TDE with customer-managed keys and automatic rotation.

Answer

Enable TDE with service-managed keys and use Azure Policy to enforce rotation.

Answer

Use Always Encrypted with column master key in Azure Key Vault and manual rotation.

Answer

Use Azure Storage Service Encryption with customer-managed keys and enable soft delete.

Question 15

You are designing security for a web application that will be developed by an external vendor. The vendor will have access to the source code repository and the development environment. You need to ensure that no secrets (e.g., API keys, connection strings) are stored in the source code. What is the best approach to manage secrets for this application?

Accepted Answer

Use Azure Key Vault to store secrets and configure the application to use managed identity to retrieve them.. Using Azure Key Vault to store secrets and referencing them from the application is the standard best practice. The application can use managed identity to authenticate to Key Vault securely. Storing secrets in app settings is not secure if the repository is accessible. Using environment variables is better but still not as secure as Key Vault. Hardcoding is unacceptable.

Answer

Store secrets in environment variables on the application server.

Answer

Store secrets in Azure App Service application settings encrypted at rest.

Answer

Embed secrets in the compiled code using obfuscation.