SC-100 Design security solutions for applications and data Practice Test 12 — 15 Questions

Question 1

A healthcare organization uses Microsoft Purview Information Protection to classify and protect patient data. They want to automatically apply a 'High Confidentiality' label to any document containing a patient ID pattern (###-####). The label should also encrypt the document. Which configuration should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Sensitivity label with auto-labeling for sensitive info types. To automatically apply a label that encrypts documents containing a patient ID pattern, the organization should use a sensitivity label with auto-labeling configured for sensitive info types. Sensitivity labels can enforce encryption and are applied automatically based on conditions such as the presence of sensitive information types (e.g., a custom regex for ###-####).

Answer

Retention label with auto-labeling policy

Answer

Data Loss Prevention (DLP) policy with a block action

Answer

Trainable classifier with a retention policy

Question 2

Your organization uses Microsoft Sentinel to centralize security monitoring. You need to detect anomalous access to a critical Azure SQL Database from unusual geographic locations. Which data connector and analytic rule should you use?

Accepted Answer

Azure SQL Database connector and a custom scheduled query rule with geo-location. The correct option is A: Azure SQL Database connector and a custom scheduled query rule with geo-location. The Azure SQL Database connector ingests SQL audit and diagnostic logs into Microsoft Sentinel, which include client IP addresses, so a custom scheduled analytics rule can parse those IPs, enrich them with geo-location data (e.g., via the GeoIP watchlist or built-in functions), and alert on access from unusual regions. Option B does not fit because Microsoft Entra ID sign-in anomaly rules cover identity authentication events, not direct database access. Option C is wrong because Windows Security Events cover OS-level logons on Windows hosts, not Azure SQL Database access. Option D is wrong because Azure Activity logs track control-plane operations like resource deletion, not data-plane SQL connections.

Answer

Azure Active Directory connector and an anomaly rule for sign-ins

Answer

Windows Security Events connector and a rule for failed logins

Answer

Azure Activity connector and a rule for resource deletion

Question 3

Your company uses Microsoft Defender for Cloud to secure Azure workloads. You need to ensure that all storage accounts have the 'Secure transfer required' setting enabled. What should you use?

Accepted Answer

Azure Policy. Azure Policy can audit and enforce the 'Secure transfer required' setting across all storage accounts. Option A (RBAC) is incorrect because RBAC controls access permissions, not resource configuration. Option B (Azure Blueprints) is deprecated and not the direct solution for this requirement. Option C (Microsoft Defender for Cloud regulatory compliance dashboard) provides visibility but does not enforce settings.

Answer

Azure role-based access control (RBAC)

Answer

Azure Blueprints

Answer

Microsoft Defender for Cloud regulatory compliance dashboard

Question 4

A company is implementing Microsoft Priva to manage subject rights requests. Users submit requests to access their personal data stored in Exchange Online, SharePoint, and Teams. The privacy team needs to automate the retrieval of data from these sources. Which Priva capability should they use?

Accepted Answer

Subject Rights Requests. Microsoft Priva's Subject Rights Requests capability is purpose-built to automate the intake, search, and fulfillment of data subject access requests (DSARs) across Microsoft 365 workloads including Exchange Online, SharePoint, OneDrive, and Teams. It provides templates, automated searches, and review workflows that map directly to the scenario described.

Answer

Consent Management

Answer

Data Inventory

Answer

Data Breach Notifications

Question 5

Your company uses Microsoft Intune to manage mobile devices. You need to ensure that corporate data in Microsoft 365 apps cannot be copied to personal apps on the same device. What should you configure?

Accepted Answer

App protection policy (MAM) with 'Restrict cut, copy, and paste'. An App protection policy (MAM) with 'Restrict cut, copy, and paste'. App protection policies in Intune operate at the app layer, so they can block copying corporate data from Microsoft 365 apps into personal apps on the same device, even on unmanaged or BYOD devices. This directly addresses the requirement to prevent data leakage between managed and personal apps. Option B (Conditional Access requiring a compliant device) controls access to resources but does not prevent copy/paste between apps. Option C (device configuration profile with restrictions) applies device-level settings and cannot selectively govern app-to-app data sharing. Option D (device compliance policy) only evaluates and reports device state; it does not enforce app-level copy/paste restrictions.

Answer

Conditional Access policy requiring compliant device

Answer

Device configuration profile with restrictions

Answer

Device compliance policy for mobile devices

Question 6

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft 365. You need to create a DLP policy that detects and blocks sharing of credit card numbers in Exchange Online emails. Which TWO components must you configure?

Accepted Answer

Action to block sharing. Option D is correct because a DLP policy must reference a sensitive information type (SIT) — in this case the built-in 'Credit Card Number' SIT — so Purview can detect the credit card patterns in Exchange Online email content. Option C is correct because detection alone does nothing; the policy rule must define an action such as 'Block' (or restrict access/encrypt) to prevent the credit card data from being shared via email. Option A is incorrect because retention labels govern data lifecycle and retention, not real-time blocking of sensitive data sharing. Option B is incorrect because auto-labeling policies apply sensitivity labels to content and do not enforce DLP blocking actions. Option E is incorrect because trainable classifiers are used for custom content categories (e.g., resumes, contracts), not for detecting standardized numeric patterns like credit card numbers, which are handled by built-in SITs.

Answer

Retention label for financial data

Answer

Auto-labeling policy

Answer

Trainable classifier for credit card numbers

Question 7

Your organization wants to enable Microsoft Defender for Cloud Apps to monitor and control the use of Box and Dropbox. Which TWO steps must you perform?

Accepted Answer

Connect the app using an app connector. Option A is correct because Defender for Cloud Apps monitors and governs sanctioned SaaS apps such as Box and Dropbox by connecting them through an app connector (API connector), which uses the app's APIs and OAuth to pull activity logs, files, and user data for governance and control. Option D is correct because Conditional Access App Control (session control) uses Microsoft Entra Conditional Access policies and a reverse proxy to enforce real-time session controls like block download, block upload, and read-only access for Box and Dropbox. Option B is incorrect because adding apps to the unsanctioned list only tags them in Cloud Discovery as unsanctioned; it does not enable monitoring or control of the apps. Option C is incorrect because a forward proxy is not required; Cloud Discovery can use log upload or Defender for Cloud Apps log collectors, and session control uses a reverse proxy, not a forward proxy. Option E is incorrect because running a Cloud Discovery report only provides visibility into discovered apps and does not by itself enable monitoring and control of Box and Dropbox.

Answer

Add Box and Dropbox to the unsanctioned list

Answer

Deploy a forward proxy

Answer

Run a cloud discovery report

Question 8

You are reviewing a Conditional Access policy in Microsoft Entra ID. The policy is intended to block sign-ins from high-risk users. However, some high-risk users are still able to sign in. What is the most likely reason?

Accepted Answer

The policy is not enforced because user risk is not being evaluated (e.g., missing licenses or risk policy). The policy is not enforced because user risk is not being evaluated (e.g., missing licenses or risk policy). For a Conditional Access policy that blocks high-risk users to work, Microsoft Entra ID Protection must actually compute user risk, which requires Entra ID P2 (or equivalent) licensing and the risk detections feeding the risk level; if risk is never evaluated, the condition never matches and high-risk users sign in. Report-only mode (C) would also let users through, but it is a deliberate configuration state rather than the most likely cause of risk-based enforcement silently failing, and the scenario implies the policy is intended to be active. Options B and D are irrelevant here because client app types and locations are separate conditions that do not affect whether user risk is evaluated.

Answer

The policy does not include all client app types

Answer

The policy is set to report-only mode

Answer

The policy does not include all locations

Question 9

You are reviewing an ARM template snippet that creates a blob container. The security team requires that the container be accessible only via authorized Azure AD identities, not via anonymous access. Based on the exhibit, is the configuration correct?

Accepted Answer

Yes, the setting 'publicAccess': 'None' prevents anonymous access, and Azure AD authentication is available by default. Option C is correct because setting 'publicAccess' to 'None' on a blob container disables anonymous read access, and Microsoft Entra ID (Microsoft Entra ID) authorization is always available for Blob Storage data-plane operations when a caller presents a valid OAuth 2.0 token with the appropriate RBAC role. No additional template property is required to enable Microsoft Entra ID authentication; it is a service-level capability. Option A is wrong because disabling shared key access is an optional hardening step, not a prerequisite for Microsoft Entra ID-only access. Option B is wrong because 'Blob' or 'Container' publicAccess values actually permit anonymous read access, the opposite of the requirement. Option D is wrong because firewall rules restrict network origin, not the authentication method, and are not required to enforce Microsoft Entra ID authorization.

Answer

Yes, but you also need to disable shared key access

Answer

No, you need to set 'publicAccess' to 'Blob' to restrict access

Answer

No, you must also configure a firewall rule to restrict access to Azure AD users

Question 10

Your company develops a web application hosted on Azure App Service. The application uses Azure SQL Database and requires managed identities to access the database. You need to ensure that the application can authenticate to Azure SQL without storing credentials in code. Which authentication method should you implement?

Accepted Answer

Enable system-assigned managed identity on the App Service and grant it access to the SQL database.. Enabling a system-assigned managed identity on the Azure App Service creates an identity in Microsoft Entra ID tied to the app's lifecycle, and that identity can be granted access to Azure SQL Database (for example, by creating a contained database user with CREATE USER [app-name] FROM EXTERNAL PROVIDER and assigning db_datareader/db_datawriter roles), letting the app authenticate without storing any credentials in code. This is the recommended passwordless approach for App Service to Azure SQL. Option A still requires managing and referencing a client certificate, which is credential material rather than eliminating secrets. Option B uses a service principal with a client secret, which is exactly the stored credential the scenario wants to avoid. Option C only restricts network access via firewall rules and does not provide authentication or authorization to the database.

Answer

Store a client certificate in Azure Key Vault and reference it from the app.

Answer

Use an Azure AD service principal with a client secret.

Answer

Use Azure SQL database-level firewall rules with a static IP restriction.

Question 11

Your company uses Microsoft Purview to classify and protect sensitive data. You need to ensure that when a user sends an email containing a credit card number, the email is automatically encrypted and a notification is sent to the user. Which Microsoft Purview feature should you configure?

Accepted Answer

Data Loss Prevention (DLP) policies. Data Loss Prevention (DLP) policies in Microsoft Purview are the correct choice because they can inspect email content for sensitive information types such as credit card numbers and trigger protective actions like encryption and user notifications. DLP rules support conditions based on sensitive info types and actions including encrypting messages and sending policy tips or notifications to the sender. Sensitivity labels apply protection based on manual or auto-labeling, but they do not natively detect credit card numbers in transit and send user notifications in the same rule-based way. Audit log policies only record activity for later review, and insider risk management policies focus on detecting risky user behavior rather than automatically encrypting an email containing a credit card number.

Answer

Sensitivity labels

Answer

Audit log policies

Answer

Insider risk management policies

Question 12

Your organization uses Microsoft Intune to manage devices. You need to deploy a line-of-business (LOB) app to iOS devices that is not available in the public App Store. The app is signed with an enterprise certificate. Which app deployment method should you use?

Accepted Answer

iOS line-of-business app deployment in Intune. iOS line-of-business app deployment in Intune. Intune supports deploying custom in-house iOS apps via the iOS LOB app type, which uploads the signed .ipa file and installs it on enrolled devices without requiring the public App Store, matching the scenario of an enterprise-certificate-signed LOB app. Option A (Android Enterprise managed Google Play) is for Android apps distributed through managed Google Play, not iOS. Option B (VPP token) is used for purchasing and distributing App Store apps in volume, not for custom in-house iOS apps. Option C (Microsoft Store for Business) distributes Windows apps and is unrelated to iOS deployment.

Answer

Android Enterprise managed Google Play

Answer

Volume Purchase Program (VPP) token

Answer

Microsoft Store for Business

Question 13

Your company uses Microsoft Sentinel for security operations. You need to design a solution that automatically remediates a detected threat by blocking a malicious IP address on Azure Firewall. Which Microsoft Sentinel feature should you use?

Accepted Answer

SOAR playbooks. Security Orchestration, Automation, and Response (SOAR) in Microsoft Sentinel uses playbooks to automate remediation actions like blocking IPs on Azure Firewall. Option A is wrong because analytics rules only generate alerts. Option B is wrong because workbooks visualize data. Option D is wrong because UEBA analyzes behavior but does not automate remediation.

Answer

Analytics rules

Answer

Workbooks

Answer

User and Entity Behavior Analytics (UEBA)

Question 14

Your application uses Azure Key Vault to store secrets. You need to ensure that the application rotates secrets automatically without downtime. Which feature should you enable?

Accepted Answer

Key Vault automatic rotation with Event Grid integration. Key Vault automatic rotation with Event Grid integration (option A) is correct because it lets Key Vault rotate secrets on a schedule and emit near-real-time events (e.g., Microsoft.KeyVault.SecretNewVersionCreated) that the application can subscribe to, so it can fetch the new secret version before the old one expires and avoid downtime. Manual rotation (option B) requires an operator to create new secret versions, which cannot guarantee timely, zero-downtime rotation. Soft-delete (option C) only retains deleted vaults/secrets for recovery and does not rotate anything. RBAC (option D) governs authorization to Key Vault operations but provides no rotation mechanism.

Answer

Key Vault manual rotation

Answer

Key Vault soft-delete

Answer

Key Vault RBAC

Question 15

Your company uses Microsoft Entra ID for identity management. You need to implement a solution that allows external partners to access a specific application using their own identity providers, while ensuring that their accounts are automatically deprovisioned when removed from their home organization. Which feature should you use?

Accepted Answer

Entitlement management with connected organizations. Entitlement management with connected organizations in Microsoft Entra ID (part of Identity Governance) is designed exactly for this scenario: it lets you onboard external partners, define access packages tied to their home identity providers, and automatically deprovision access when the user leaves their home organization via lifecycle workflows and connected-organization sync. This provides both the cross-tenant access and the automatic deprovisioning requirement.

Answer

B2B direct federation

Answer

Self-service sign-up

Answer

Identity Governance access reviews