SC-100 Design security solutions for applications and data Practice Test 12 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to protect its Azure workloads. You have an application that runs on Azure Virtual Machines and uses a storage account to store sensitive data. The security team wants to detect when the storage account access keys are used from an unexpected location. What should you configure?

Accepted Answer

Enable Microsoft Defender for Storage and configure anomaly detection alerts.. Microsoft Defender for Cloud provides adaptive application controls, file integrity monitoring, and just-in-time access, but not specifically for detecting storage key usage from unexpected locations. Microsoft Defender for Storage (part of Defender for Cloud) provides anomaly detection, including unusual access patterns. You can also use Azure Monitor with alerts on storage metrics, but the most direct is Defender for Storage. Option D is correct.

Answer

Configure adaptive application controls on the storage account.

Answer

Create an Azure Monitor alert based on the 'Storage Account List Keys' operation.

Answer

Enable just-in-time VM access in Microsoft Defender for Cloud.

Question 2

A company is designing a microservices architecture on Azure Kubernetes Service (AKS). Each microservice needs to authenticate to Azure SQL Database using its own identity. The security team requires that no service principal secrets or certificates be stored in the cluster. What should you implement to authenticate the microservices to Azure SQL Database?

Accepted Answer

Use Azure AD Workload Identity for each pod to authenticate to Azure SQL Database using managed identities.. Azure AD Workload Identity (formerly AAD Pod Identity) allows pods to assume an Azure AD identity and authenticate to Azure resources without secrets. This integrates with Azure SQL's Azure AD authentication. Option A is the correct approach. Service Principal with Key Vault still stores a secret. Managed identity at the node level is too broad. Storage of client secrets is not allowed.

Answer

Create a service principal and store its secret in Azure Key Vault; use the Key Vault Secrets Store CSI driver to mount it.

Answer

Enable a system-assigned managed identity on the AKS cluster nodes and have pods use it.

Answer

Store the Azure SQL connection string with credentials in a Kubernetes secret.

Question 3

Your organization uses Microsoft Purview to classify and protect sensitive data. You need to prevent users from accidentally sharing files that contain credit card numbers via email. What should you configure in Microsoft Purview?

Accepted Answer

Implement a data loss prevention (DLP) policy that detects credit card numbers and blocks email sharing.. Data Loss Prevention (DLP) policies in Microsoft Purview can detect sensitive information types like credit card numbers and block sharing via email. Sensitivity labels can be applied automatically but do not block sharing by themselves. The correct answer is DLP policy.

Answer

Enable Microsoft Defender for Cloud Apps session policy to monitor file downloads.

Answer

Configure a retention policy for files containing credit card numbers.

Answer

Create a sensitivity label that automatically classifies credit card numbers.

Question 4

You are designing a solution to protect an Azure App Service web app that authenticates users via Microsoft Entra ID. The app needs to ensure that only users from specific external partner organizations can access it. You do not want to create user objects for each partner user in your tenant. What should you configure?

Accepted Answer

Enable Microsoft Entra B2B collaboration and configure the application to accept tokens from partner tenants.. B2B collaboration allows external users to use their own identities without creating separate user objects. B2C is for customer-facing apps. Conditional Access policies can restrict access but require user objects. Application permissions are for app-to-app scenarios. Option D is correct.

Answer

Configure a Conditional Access policy that restricts access to partners' IP ranges.

Answer

Create guest user accounts for each external user and assign them to a group.

Answer

Use Azure AD B2C custom policies to allow partner authentication.

Question 5

A company is migrating a legacy on-premises application to Azure. The application currently uses Windows Integrated Authentication (Kerberos) and requires access to a SQL Server database on the same network. In Azure, the application will run on Azure Virtual Machines and the database will be migrated to Azure SQL Managed Instance. You need to ensure the application can authenticate to the database without storing credentials. What should you implement?

Accepted Answer

Join the virtual machine to an Azure AD Domain Services domain and configure the application to use Azure AD Kerberos authentication.. Azure SQL Managed Instance supports Azure AD authentication. By joining the VM to an Azure AD Domain Services domain and using Azure AD Kerberos authentication, the application can use Windows Integrated Authentication to connect to the managed instance without storing credentials. Option D is correct. Key Vault is unnecessary. SQL authentication requires credentials. Service principal is not compatible with Kerberos.

Answer

Store the database credentials in Azure Key Vault and retrieve them at runtime.

Answer

Use SQL authentication with a contained database user.

Answer

Create a service principal in Azure AD and grant it access to the database.

Question 6

Your organization uses Microsoft Sentinel as its SIEM. You need to collect logs from a custom line-of-business application that does not support standard syslog or Windows Event Log. The application writes logs to a text file on a Windows server. What is the most efficient way to ingest these logs into Microsoft Sentinel?

Accepted Answer

Install the Log Analytics Agent (deprecated, but still available) on the server and configure custom log collection.. The Log Analytics Agent can collect custom text logs by specifying the log file path and parsing rules. This is the most direct method. Syslog is for Linux. Azure Monitor Agent does not support custom text logs natively. Event Hubs would require additional configuration. Option A is correct.

Answer

Configure the application to send logs to a syslog server and use a syslog connector.

Answer

Set up a Azure Event Hubs and have the application write logs to Event Hubs.

Answer

Use the Azure Monitor Agent to collect the text file via a custom data source.

Question 7

A company is designing a secure data sharing solution with a partner organization. The data will be stored in Azure Blob Storage. Requirements include: encryption at rest with customer-managed keys, granular access control to specific blobs, and the ability to expire access automatically. Which TWO solutions should you combine? (Choose two.)

Accepted Answer

Generate shared access signatures (SAS) with specific permissions and expiry times.. Azure Storage Service Encryption with customer-managed keys (CMK) provides encryption at rest. Shared access signatures (SAS) provide granular, time-limited access to specific blobs. RBAC is less granular (container level). Azure AD authentication is not time-limited by default. Option A and C together meet all requirements.

Answer

Enable Azure Active Directory authentication for the storage account.

Answer

Configure a firewall on the storage account to allow only partner IP addresses.

Answer

Use Azure RBAC to assign the Storage Blob Data Reader role to partner users.

Question 8

Your organization uses Azure DevOps for CI/CD. You need to ensure that secrets (e.g., API keys) used in pipeline tasks are securely stored and accessed. The security requirements are: secrets must be encrypted at rest, access must be audited, and secrets must be automatically rotated. Which THREE services or features should you use? (Choose three.)

Accepted Answer

Azure Key Vault access policy to grant permissions.. Azure Key Vault provides encrypted storage for secrets with access auditing. Managed identities allow secure access without storing credentials. Key Vault supports automatic rotation for some secret types. Azure DevOps Variable Groups can link to Key Vault but do not provide rotation. Azure AD is not a secret store. Pipeline secrets are not centrally managed. Options A, B, and C together meet all requirements.

Answer

Azure DevOps Variable Groups to store secrets.

Answer

Azure Active Directory service principal to access secrets.

Question 9

A company is deploying a new API management solution using Azure API Management. The APIs will be consumed by external partners. Security requirements include: protecting against OWASP Top 10 attacks, throttling requests per subscription, and validating JSON schemas. Which TWO policies should you configure? (Choose two.)

Accepted Answer

Validate content policy to check JSON schema.. Azure API Management policies can be added to protect APIs. The 'Validate JWT' policy is for token validation, not OWASP protection. The 'Rate limit' policy throttles requests per subscription. The 'Validate content' policy can validate JSON schemas. The 'Cross domain' policy is for CORS. The 'IP filter' restricts by IP. Options B and D meet the requirements.

Answer

Validate JWT policy to ensure tokens are valid.

Answer

IP filter policy to restrict access to partner IPs.

Answer

Cross domain policy to allow CORS.

Question 10

A large financial services company is migrating its customer-facing web application to Azure. The application handles sensitive personal data and must comply with PCI DSS. The solution will use Azure App Service (Linux) with a custom container, Azure SQL Database, and Azure Redis Cache. The security architect mandates that all data in transit be encrypted using the latest TLS version, and that the application must be protected against common web vulnerabilities. The company also wants to ensure that only authenticated users can access the Redis cache. Users will authenticate via Microsoft Entra ID. The operations team needs to be able to monitor for SQL injection attempts and anomalous access patterns. You need to design the security configuration. Which of the following is the most comprehensive approach that meets all requirements?

Accepted Answer

Configure App Service to enforce TLS 1.2 as minimum. Deploy Azure Application Gateway with WAF enabled in front of App Service. Enable Azure AD authentication for Azure Redis Cache. Enable Microsoft Defender for SQL for Azure SQL Database.. Azure App Service enforces TLS 1.2/1.3 by default. Azure WAF (Web Application Firewall) in front of App Service protects against OWASP Top 10. Azure AD authentication for Redis Cache is supported via Azure AD RBAC for Redis (currently in preview but available). Microsoft Defender for SQL detects SQL injection and anomalous access. Option A covers all requirements. Option B uses Application Gateway without WAF. Option C uses Redis firewall which doesn't enforce authentication. Option D uses Azure Front Door without WAF.

Answer

Use Azure Front Door with custom domain and enforce TLS 1.2. Configure IP firewall on Redis Cache. Use Azure SQL Database with VNet service endpoints.

Answer

Deploy App Service with HTTPS only enabled. Use Azure API Management with WAF. Use Redis Cache with access keys. Enable SQL audit logging.

Answer

Enable TLS 1.3 on App Service. Use Azure CDN with WAF. Configure Redis Cache with a firewall rule allowing only App Service outbound IPs.

Question 11

A healthcare organization is using Microsoft Purview to govern its data estate. They have multiple Azure Data Lake Storage accounts and Azure SQL Databases. They need to classify sensitive data such as patient health information (PHI) and apply protection automatically when data is exported from these sources to an external location. The organization also wants to prevent unauthorized users from accessing sensitive data in Azure SQL Database by using built-in security features. The compliance team requires that any access to sensitive data be logged and auditable. You need to design a solution that meets these requirements. What should you implement?

Accepted Answer

Use Microsoft Purview to scan and classify data. Auto-apply sensitivity labels. Implement Azure AD authentication and row-level security in Azure SQL Database. Enable auditing and send to Log Analytics.. Microsoft Purview can scan data sources and classify sensitive data. Sensitivity labels can be applied automatically based on classification. Azure SQL Database supports Azure AD authentication and row-level security to restrict access. Auditing logs can be sent to Log Analytics. Option B combines all these. Option A uses Azure Information Protection (now part of Purview) but does not cover SQL access control. Option C uses data masking which doesn't prevent access. Option D uses Defender for Cloud but not data classification.

Answer

Use Microsoft Purview to scan and classify data. Apply sensitivity labels manually. Configure Azure SQL Database firewall to block all but admin. Use Azure SQL auditing.

Answer

Use Microsoft Defender for Cloud to identify sensitive data. Implement Azure SQL Database always encrypted. Use Azure Monitor to log queries.

Answer

Use Microsoft Purview to classify data. Apply data masking in Azure SQL Database for PHI columns. Use Azure SQL Database threat detection.

Question 12

A company uses Microsoft Defender for Cloud Apps to protect SaaS applications. The security team receives alerts about suspicious file downloads from a specific user. They want to automatically block the user's account when the risk score exceeds 80. What should they configure?

Accepted Answer

Create an access policy. Option B is correct because an access policy in Defender for Cloud Apps can automatically block a user based on risk score. Option A is wrong because session policies control real-time monitoring, not blocking. Option C is wrong because app governance policies manage consent and permissions. Option D is wrong because Conditional Access app control is for session-level controls.

Answer

Configure Conditional Access app control

Answer

Create a session policy

Answer

Create an app governance policy

Question 13

You are designing a secure data classification strategy for documents in Microsoft 365. The compliance officer wants to automatically apply a 'Confidential' label to documents containing credit card numbers. Which Microsoft Purview feature should you use?

Accepted Answer

Auto-labeling policies. Option C is correct because auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels based on sensitive info types. Option A is wrong because trainable classifiers require training and are for more complex patterns. Option B is wrong because manual labeling is not automatic. Option D is wrong because data loss prevention policies prevent sharing but do not apply labels.

Answer

Data loss prevention policies

Answer

Trainable classifiers

Answer

Manual labeling

Question 14

Refer to the exhibit. You are evaluating a custom Azure Policy definition for storage accounts. The policy is assigned with effect set to 'Deny'. An administrator attempts to create a new storage account with network rules configured to allow all traffic (defaultAction set to Allow). What will happen?

Accepted Answer

The storage account creation is denied.. Option B is correct because the policy denies creation when networkAcls.defaultAction is not 'Deny'. Option A is wrong because the policy denies, not audits. Option C is wrong because the policy does not modify the resource. Option D is wrong because the policy explicitly denies.

Answer

The storage account is created, and the network rules are automatically changed to deny all traffic.

Answer

The storage account is created, and an audit event is generated.

Answer

The storage account is created successfully, and no action is taken.

Question 15

A retail company uses Microsoft Defender for APIs to protect its online store API. The security team notices unusual API calls from an IP address that is not in the allowed list. They want to block this IP address for 24 hours. What should they configure?

Accepted Answer

Create a rate-limiting rule. Option A is correct because Defender for APIs allows creating a rate-limiting rule to block an IP. Option B is wrong because API schema validation validates request structure, not blocks IPs. Option C is wrong because authentication settings verify tokens. Option D is wrong because API collections group APIs.

Answer

Configure API schema validation

Answer

Modify the authentication settings

Answer

Update the API collection