SC-100 Design security solutions for applications and data Practice Test 13 — 15 Questions

Question 1

Your company uses Microsoft Defender for Cloud Apps to protect its SaaS environment. You need to configure settings to detect and block risky user activities. Which TWO actions should you take? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure anomaly detection policies.. Option C is correct because anomaly detection policies in Microsoft Defender for Cloud Apps are specifically designed to detect unusual user behavior—such as impossible travel, atypical download volumes, or suspicious admin activity—and can be tuned to alert on or automatically remediate risky activities in your SaaS environment. Option E is correct because enabling session monitoring (via Conditional Access App Control) for critical applications lets Defender for Cloud Apps inspect and control user sessions in real time, allowing it to block risky actions like downloads, uploads, or copy/paste based on session policies. Option A is not appropriate because blocking all third-party app access is an overly broad, disruptive measure rather than a targeted risky-activity detection and blocking configuration. Option B does not belong because defining IP address ranges for trusted locations only informs risk evaluation and conditional access decisions; by itself it neither detects nor blocks risky user activities. Option D is incorrect because app discovery policies focus on identifying shadow IT and unsanctioned cloud apps from traffic logs, not on detecting and blocking risky user activities within sanctioned SaaS apps.

Answer

Block all third-party app access.

Answer

Define IP address ranges for trusted locations.

Answer

Configure app discovery policies.

Question 2

Refer to the exhibit. You run the PowerShell script to protect high-confidentiality resources. After execution, you find that some resources with tag 'Confidentiality=High' are still unprotected. What is the most likely reason?

Accepted Answer

Some resources are in a different resource group than expected.. The correct answer is A: some resources are in a different resource group than expected. If the PowerShell script scopes its protection (for example, applying locks or policies) to a specific resource group, any resource tagged 'Confidentiality=High' that resides in another resource group is outside the script's scope and remains unprotected, which matches the symptom of some tagged resources still being unprotected. Option B is not the likely cause because the failure is about scope, not lock-detection logic. Option C is incorrect because tag inheritance from resource groups is not the issue here—the resources already carry the tag. Option D is irrelevant because overwriting existing locks would not leave tagged resources unprotected.

Answer

The script does not check for existing locks properly.

Answer

Tags are not inherited from resource groups.

Answer

The script overwrites existing locks.

Question 3

Your organization uses Microsoft Entra ID and plans to implement a custom line-of-business application that accesses Microsoft Graph APIs. The application will be used by employees and external partners. You need to ensure that the application can authenticate users and obtain appropriate permissions without exposing the client secret. What should you implement?

Accepted Answer

Implement OAuth 2.0 authorization code flow with PKCE.. The application is a line-of-business app used by employees and external partners, which implies it may be a public client (e.g., mobile or desktop) that cannot securely store a client secret. OAuth 2.0 authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended authentication pattern for such clients because it eliminates the need for a client secret by using a dynamically generated code verifier. This ensures the client secret is never exposed. Option B is correct. Option A (system-assigned managed identity) is only suitable for Azure-hosted services, not client applications. Option C (storing client secret in Key Vault) still requires secret retrieval at runtime, which can be insecure for public clients. Option D (implicit grant flow) is outdated and less secure than authorization code flow with PKCE.

Answer

Use a system-assigned managed identity to authenticate to Microsoft Graph.

Answer

Store the client secret in Azure Key Vault and retrieve it at runtime.

Answer

Register the application as a public client and use the implicit grant flow.

Question 4

A company is deploying a new application that will store sensitive customer data in Azure SQL Database. The security team requires that all data at rest be encrypted using a customer-managed key stored in Azure Key Vault. Additionally, they need to ensure that the database can be restored to a point in time and that the encryption key is rotated every 90 days. Which combination of features should you configure?

Accepted Answer

Enable TDE with customer-managed keys in Azure Key Vault and configure automatic key rotation.. Option D is correct because Transparent Data Encryption (TDE) with customer-managed keys (CMK) in Azure Key Vault encrypts Azure SQL Database data at rest, and TDE supports point-in-time restore (PITR) via automated backups while allowing automatic key rotation through the Key Vault key rotation policy. Configuring TDE with a CMK satisfies the requirement that the encryption key be customer-managed and rotated every 90 days. Option A is wrong because service-managed keys do not meet the customer-managed key requirement, and Azure Policy cannot itself rotate TDE protector keys. Option B is wrong because Always Encrypted protects data in use and in transit at the client, not data at rest as required, and manual rotation does not meet the 90-day automated rotation need. Option C is wrong because Azure Storage Service Encryption applies to Azure Storage, not Azure SQL Database, and soft delete is a Key Vault data-protection feature, not a database encryption solution.

Answer

Enable TDE with service-managed keys and use Azure Policy to enforce rotation.

Answer

Use Always Encrypted with column master key in Azure Key Vault and manual rotation.

Answer

Use Azure Storage Service Encryption with customer-managed keys and enable soft delete.

Question 5

You are designing security for a web application that will be developed by an external vendor. The vendor will have access to the source code repository and the development environment. You need to ensure that no secrets (e.g., API keys, connection strings) are stored in the source code. What is the best approach to manage secrets for this application?

Accepted Answer

Use Azure Key Vault to store secrets and configure the application to use managed identity to retrieve them.. Using Azure Key Vault to store secrets and referencing them from the application is the standard best practice. The application can use managed identity to authenticate to Key Vault securely. Storing secrets in app settings is not secure if the repository is accessible. Using environment variables is better but still not as secure as Key Vault. Hardcoding is unacceptable.

Answer

Store secrets in environment variables on the application server.

Answer

Store secrets in Azure App Service application settings encrypted at rest.

Answer

Embed secrets in the compiled code using obfuscation.

Question 6

A company is designing a microservices architecture on Azure Kubernetes Service (AKS). Each microservice needs to authenticate to Azure SQL Database using its own identity. The security team requires that no service principal secrets or certificates be stored in the cluster. What should you implement to authenticate the microservices to Azure SQL Database?

Accepted Answer

Use Azure AD Workload Identity for each pod to authenticate to Azure SQL Database using managed identities.. Microsoft Entra ID Workload Identity is the correct choice because it federates a Kubernetes service account with an Microsoft Entra ID managed identity, allowing each pod to obtain Microsoft Entra ID tokens without any stored secrets or certificates in the cluster. This directly satisfies the requirement that each microservice authenticates with its own identity and that no service principal secrets or certificates be stored. Option A is wrong because it still relies on a service principal secret stored in Key Vault and mounted into the cluster. Option B is wrong because a node-level system-assigned managed identity is shared by all pods on the node, so it does not give each microservice its own identity. Option D is wrong because storing credentials in a Kubernetes secret violates the no-secrets requirement and is not identity-based authentication.

Answer

Create a service principal and store its secret in Azure Key Vault; use the Key Vault Secrets Store CSI driver to mount it.

Answer

Enable a system-assigned managed identity on the AKS cluster nodes and have pods use it.

Answer

Store the Azure SQL connection string with credentials in a Kubernetes secret.

Question 7

Your organization uses Microsoft Purview to classify and protect sensitive data. You need to prevent users from accidentally sharing files that contain credit card numbers via email. What should you configure in Microsoft Purview?

Accepted Answer

Implement a data loss prevention (DLP) policy that detects credit card numbers and blocks email sharing.. A DLP policy in Microsoft Purview is purpose-built to detect sensitive information types such as credit card numbers (via the built-in 'Credit Card Number' SIT, which uses regex plus Luhn checksum validation) and to enforce protective actions like blocking email sharing. DLP policies can be scoped to Exchange Online, SharePoint, OneDrive, and Teams, and can block or encrypt content when the sensitive data is detected. This directly addresses the requirement to prevent accidental email sharing of files containing credit card numbers.

Answer

Enable Microsoft Defender for Cloud Apps session policy to monitor file downloads.

Answer

Configure a retention policy for files containing credit card numbers.

Answer

Create a sensitivity label that automatically classifies credit card numbers.

Question 8

You are designing a solution to protect an Azure App Service web app that authenticates users via Microsoft Entra ID. The app needs to ensure that only users from specific external partner organizations can access it. You do not want to create user objects for each partner user in your tenant. What should you configure?

Accepted Answer

Enable Microsoft Entra B2B collaboration and configure the application to accept tokens from partner tenants.. Option B is correct because Microsoft Entra B2B collaboration lets partner users authenticate with their own organizational credentials and receive tokens from their home tenant, which the app can accept without creating user objects in your tenant. This directly satisfies the requirement to allow only specific external partner organizations while avoiding per-user objects in your directory. Option A is insufficient because IP-range restrictions do not identify or validate partner organizations and can be bypassed or misapplied. Option C contradicts the requirement by creating guest user objects for each external user. Option D is wrong because Azure AD B2C is intended for customer-facing identity scenarios with local or social accounts, not for federating access with specific partner Microsoft Entra tenants.

Answer

Configure a Conditional Access policy that restricts access to partners' IP ranges.

Answer

Create guest user accounts for each external user and assign them to a group.

Answer

Use Azure AD B2C custom policies to allow partner authentication.

Question 9

A company is designing a secure data sharing solution with a partner organization. The data will be stored in Azure Blob Storage. Requirements include: encryption at rest with customer-managed keys, granular access control to specific blobs, and the ability to expire access automatically. Which TWO solutions should you combine? (Choose two.)

Accepted Answer

Generate shared access signatures (SAS) with specific permissions and expiry times.. Option A is correct because shared access signatures (SAS) let you delegate granular, time-limited access to specific blobs or containers, specifying exact permissions (read, write, etc.) and an expiry time, which directly satisfies the requirements for granular access control and automatic access expiration. Option E is correct because Azure Storage Service Encryption with customer-managed keys stored in Azure Key Vault provides encryption at rest where the customer controls the key lifecycle, meeting the customer-managed key requirement. Option B is not correct because enabling Microsoft Entra ID authentication alone does not provide granular per-blob access or automatic expiry; it is an authentication mechanism, not an access delegation or expiration feature. Option C is not correct because IP firewall rules restrict network access but do not provide granular blob-level permissions or automatic access expiration. Option D is not correct because the Storage Blob Data Reader role grants broad read access at the scope assigned and does not inherently expire, so it fails the granularity and automatic expiration requirements.

Answer

Enable Azure Active Directory authentication for the storage account.

Answer

Configure a firewall on the storage account to allow only partner IP addresses.

Answer

Use Azure RBAC to assign the Storage Blob Data Reader role to partner users.

Question 10

A large financial services company is migrating its customer-facing web application to Azure. The application handles sensitive personal data and must comply with PCI DSS. The solution will use Azure App Service (Linux) with a custom container, Azure SQL Database, and Azure Redis Cache. The security architect mandates that all data in transit be encrypted using the latest TLS version, and that the application must be protected against common web vulnerabilities. The company also wants to ensure that only authenticated users can access the Redis cache. Users will authenticate via Microsoft Entra ID. The operations team needs to be able to monitor for SQL injection attempts and anomalous access patterns. You need to design the security configuration. Which of the following is the most comprehensive approach that meets all requirements?

Accepted Answer

Configure App Service to enforce TLS 1.2 as minimum. Deploy Azure Application Gateway with WAF enabled in front of App Service. Enable Azure AD authentication for Azure Redis Cache. Enable Microsoft Defender for SQL for Azure SQL Database.. Azure App Service enforces TLS 1.2/1.3 by default. Azure WAF (Web Application Firewall) in front of App Service protects against OWASP Top 10. Microsoft Entra ID authentication for Redis Cache is supported via Microsoft Entra ID RBAC for Redis (currently in preview but available). Microsoft Defender for SQL detects SQL injection and anomalous access. Option A covers all requirements. Option B uses Application Gateway without WAF. Option C uses Redis firewall which doesn't enforce authentication. Option D uses Azure Front Door without WAF.

Answer

Use Azure Front Door with custom domain and enforce TLS 1.2. Configure IP firewall on Redis Cache. Use Azure SQL Database with VNet service endpoints.

Answer

Deploy App Service with HTTPS only enabled. Use Azure API Management with WAF. Use Redis Cache with access keys. Enable SQL audit logging.

Answer

Enable TLS 1.3 on App Service. Use Azure CDN with WAF. Configure Redis Cache with a firewall rule allowing only App Service outbound IPs.

Question 11

A healthcare organization is using Microsoft Purview to govern its data estate. They have multiple Azure Data Lake Storage accounts and Azure SQL Databases. They need to classify sensitive data such as patient health information (PHI) and apply protection automatically when data is exported from these sources to an external location. The organization also wants to prevent unauthorized users from accessing sensitive data in Azure SQL Database by using built-in security features. The compliance team requires that any access to sensitive data be logged and auditable. You need to design a solution that meets these requirements. What should you implement?

Accepted Answer

Use Microsoft Purview to scan and classify data. Auto-apply sensitivity labels. Implement Azure AD authentication and row-level security in Azure SQL Database. Enable auditing and send to Log Analytics.. Microsoft Purview can scan data sources like Azure Data Lake Storage and Azure SQL Database, classify sensitive data such as PHI, and auto-apply sensitivity labels. Azure SQL Database supports Microsoft Entra ID authentication and row-level security (RLS) to restrict access to sensitive data based on user identity. Auditing logs can be sent to Log Analytics for compliance. Option B is incorrect because it requires manual labeling and does not use row-level security. Option C uses Defender for Cloud (not Purview) and Always Encrypted (which does not prevent access to authorized users). Option D uses data masking (obfuscation) rather than access control and lacks auto-labeling and auditing integration.

Answer

Use Microsoft Purview to scan and classify data. Apply sensitivity labels manually. Configure Azure SQL Database firewall to block all but admin. Use Azure SQL auditing.

Answer

Use Microsoft Defender for Cloud to identify sensitive data. Implement Azure SQL Database always encrypted. Use Azure Monitor to log queries.

Answer

Use Microsoft Purview to classify data. Apply data masking in Azure SQL Database for PHI columns. Use Azure SQL Database threat detection.

Question 12

You are designing a secure data classification strategy for documents in Microsoft 365. The compliance officer wants to automatically apply a 'Confidential' label to documents containing credit card numbers. Which Microsoft Purview feature should you use?

Accepted Answer

Auto-labeling policies. Auto-labeling policies (option A) are the correct choice because they are the Microsoft Purview feature designed to automatically apply sensitivity labels to content that matches specified conditions, such as documents containing credit card numbers detected via sensitive information types. This directly satisfies the compliance officer's requirement to apply a 'Confidential' label automatically without user intervention. Data loss prevention policies (B) can detect and block or warn about sensitive content but do not apply sensitivity labels. Trainable classifiers (C) can identify content categories by example, but they are used as conditions within labeling or DLP, not as the labeling mechanism itself. Manual labeling (D) requires users to apply labels themselves, which does not meet the automation requirement.

Answer

Data loss prevention policies

Answer

Trainable classifiers

Answer

Manual labeling

Question 13

Refer to the exhibit. You are evaluating a custom Azure Policy definition for storage accounts. The policy is assigned with effect set to 'Deny'. An administrator attempts to create a new storage account with network rules configured to allow all traffic (defaultAction set to Allow). What will happen?

Accepted Answer

The storage account creation is denied.. The correct answer is A: the storage account creation is denied. Because the Azure Policy definition is assigned with the effect set to 'Deny', Azure Policy evaluates the resource request before deployment and blocks any storage account whose network rules use defaultAction set to Allow, so the create operation fails with a policy violation. Deny is a preventive enforcement effect, not a remediation or audit effect, so it stops the request rather than modifying the resource. Option B is wrong because Azure Policy does not automatically rewrite network rules to deny all traffic, and option C is wrong because audit events are produced by the Audit effect, not Deny. Option D is wrong because Deny actively blocks the noncompliant creation instead of allowing it with no action.

Answer

The storage account is created, and the network rules are automatically changed to deny all traffic.

Answer

The storage account is created, and an audit event is generated.

Answer

The storage account is created successfully, and no action is taken.

Question 14

A company uses Microsoft Sentinel to detect threats. They want to automatically send an email to the security team when a high-severity incident is created. What should they configure?

Accepted Answer

An analytics rule with an automated response. The correct option is A, an analytics rule with an automated response, because in Microsoft Sentinel analytics rules generate incidents from detected events, and their automated response (via automation rules or playbooks triggered on incident creation) can send an email to the security team when a high-severity incident is created. This directly satisfies the requirement of automatic notification upon incident creation. A workbook (B) is only a visualization/reporting dashboard and does not trigger notifications. A watchlist (C) stores reference data for enrichment or correlation and cannot send emails. A hunting query (D) is a manual, proactive search for threats and does not automatically notify anyone.

Answer

A workbook

Answer

A watchlist

Answer

A hunting query

Question 15

A company uses Azure Cosmos DB with Microsoft Defender for Cloud to protect its NoSQL database. The security team wants to audit all data plane operations for compliance. Which diagnostic setting should they enable?

Accepted Answer

DataPlaneRequests. The correct option is D, DataPlaneRequests. This diagnostic setting in Azure Cosmos DB logs all data plane operations, including CRUD actions on documents, which is exactly what the security team needs to audit for compliance. The other options do not fit: MongoRequests only captures requests for the MongoDB API, PartitionKeyStatistics provides metrics on partition key usage, and QueryRuntimeStatistics logs query execution details rather than a full audit of data plane operations.

Answer

MongoRequests

Answer

PartitionKeyStatistics

Answer

QueryRuntimeStatistics