SC-100 Design security solutions for applications and data Practice Test 2 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to protect Azure resources. You need to ensure that only authorized applications can access Azure Key Vault secrets. The solution must use managed identities and least privilege. What should you configure?

Accepted Answer

Assign a system-assigned managed identity to the application and grant it Key Vault Secrets User role. Option C is correct because using a system-assigned managed identity and assigning Key Vault access policies with Get and List permissions provides secure, identity-based access with least privilege. Option A is wrong because enabling public network access increases the attack surface. Option B is wrong because shared access signature tokens are less secure and harder to manage. Option D is wrong because certificate-based authentication adds complexity without managed identity benefits.

Answer

Use a shared access signature (SAS) token stored in an environment variable

Answer

Enable public network access on Key Vault and restrict inbound IP addresses

Answer

Install a client certificate on the application server and use it to authenticate to Key Vault

Question 2

You are designing a data classification strategy for Microsoft Purview. The compliance team requires that documents containing personally identifiable information (PII) like credit card numbers are automatically labeled and encrypted when stored in Microsoft SharePoint Online. The solution must use built-in sensitive information types. What should you include in the design?

Accepted Answer

Create a sensitivity label with auto-labeling for credit card numbers and enable encryption. Option D is correct because a sensitivity label with auto-labeling for content matching a sensitive information type (like credit card number) and encryption can be applied to SharePoint documents automatically. Option A is wrong because retention labels do not enforce encryption. Option B is wrong because trainable classifiers require custom training. Option C is wrong because manual labeling is not automatic.

Answer

Create a retention label and apply it automatically via a data loss prevention (DLP) policy

Answer

Use a trainable classifier to detect PII and apply a sensitivity label

Answer

Configure a manual sensitivity label policy for users to apply

Question 3

Your company uses Microsoft Defender for Cloud Apps to discover and control shadow IT. You need to block the use of a newly discovered unsanctioned cloud storage app that poses a high risk. What should you configure?

Accepted Answer

In Defender for Cloud Apps, unsanction the app and create a session policy to block it. Option A is correct because Defender for Cloud Apps allows you to sanction/unsanction apps and create access policies to block unsanctioned apps. Option B is wrong because Conditional Access policies in Entra ID control access but not app blocking. Option C is wrong because Intune compliance policies manage device compliance. Option D is wrong because Defender for Cloud Apps can block apps directly.

Answer

Create a Conditional Access policy in Microsoft Entra ID to block the app

Answer

Use Microsoft Intune to set a compliance policy that blocks the app

Answer

Add the app to the blocked list in Microsoft Defender for Cloud Apps

Question 4

You are designing an API management solution using Azure API Management. The security team requires that all API calls must be authenticated using OAuth 2.0 and that only specific Azure AD applications can access the APIs. Additionally, the solution must support rate limiting and IP filtering. What should you configure?

Accepted Answer

Configure OAuth 2.0 in Azure API Management, use validate-jwt policy to restrict to specific Azure AD apps, and add rate-limit and ip-filter policies. Option B is correct because Azure API Management can validate OAuth tokens, and you can restrict access to specific Azure AD applications using the 'validate-jwt' policy. Rate limiting and IP filtering are also built-in policies. Option A is wrong because it's not a complete solution. Option C is wrong because API keys are less secure. Option D is wrong because client certificates are not OAuth.

Answer

Set up client certificate authentication and map certificates to Azure AD apps

Answer

Enable API key authentication and restrict access using subscription keys

Answer

Use OAuth 2.0 with Azure AD and configure inbound policies to validate JWTs

Question 5

Your organization uses Microsoft Defender for Endpoint (MDE) for endpoint detection and response. You need to protect sensitive data on Windows 10 devices from being exfiltrated via USB drives. The solution must be able to audit file copy operations to USB and block them for high-risk users. What should you configure?

Accepted Answer

Deploy a device control policy in Microsoft Defender for Endpoint to audit USB usage and block for high-risk users. Option D is correct because Microsoft Defender for Endpoint includes device control features that can audit and block removable storage. You can configure policies to audit all users and block for high-risk users using custom device control policies. Option A is wrong because Intune can manage USB restrictions but not with MDE-specific auditing. Option B is wrong because DLP policies in Microsoft Purview are for cloud and network. Option C is wrong because conditional access does not control USB.

Answer

Set up a Conditional Access policy in Microsoft Entra ID to block sign-ins from devices with USB activity

Answer

Use Microsoft Intune to create a device configuration profile that disables USB ports

Answer

Configure a Microsoft Purview DLP policy for endpoint devices

Question 6

You are designing a secure DevOps pipeline using GitHub Actions and Azure. The security team requires that all container images pushed to Azure Container Registry (ACR) are scanned for vulnerabilities before deployment. If critical vulnerabilities are found, the pipeline must fail. What should you integrate into the pipeline?

Accepted Answer

Integrate Microsoft Defender for Cloud with Azure Container Registry scanning and configure a GitHub Actions step to check scan results. Option A is correct because Microsoft Defender for Cloud can scan container images in ACR for vulnerabilities and integrate with GitHub Actions to fail the pipeline on critical findings. Option B is wrong because Azure Security Center is now part of Defender for Cloud. Option C is wrong because Azure Policy can enforce compliance but not scan images. Option D is wrong because Azure Bastion is for secure remote access.

Answer

Configure Azure Policy to require image scanning before deployment

Answer

Deploy Azure Bastion to scan images during build

Answer

Use Azure Security Center (legacy) to scan images on push

Question 7

Your company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. You need to prevent users from sharing credit card numbers via email in Outlook on the web. The policy should notify users when they try to send such data and allow them to override with a business justification. What should you configure?

Accepted Answer

Create a DLP policy with the action 'Block with override' and enable 'Business justification'. Option C is correct because DLP policies can have rules that detect sensitive info types like credit card numbers, and the action 'Block with override' allows users to override with justification. Option A is wrong because 'Block' without override is too restrictive. Option B is wrong because 'Audit only' does not block. Option D is wrong because encryption alone does not block.

Answer

Create a DLP policy with the action 'Audit only' for credit card numbers

Answer

Create a DLP policy that encrypts emails containing credit card numbers

Answer

Create a DLP policy with the action 'Block' for credit card numbers

Question 8

You are designing a solution to protect Azure SQL Database from SQL injection attacks. The solution must use a web application firewall (WAF) and also ensure that queries from the application are parameterized. Which two components should you include? (Choose two. Each correct answer presents part of the solution.)

Accepted Answer

Azure Application Gateway with WAF. Options A and D are correct because Azure Application Gateway with WAF can block SQL injection at the network edge, and using parameterized queries in the application code prevents SQL injection at the application layer. Option B is wrong because TDE encrypts data at rest. Option C is wrong because Azure SQL Database firewall controls IP access.

Answer

Azure SQL Database firewall rules

Answer

Transparent Data Encryption (TDE)

Question 9

Your organization is using Microsoft Sentinel for security information and event management (SIEM). You need to ensure that data from Azure Activity Logs is ingested into Sentinel. What should you configure?

Accepted Answer

Connect Azure Activity Logs via the Microsoft Sentinel data connector. Option D is correct because you can connect Azure Activity Logs as a data connector in Microsoft Sentinel. Option A is wrong because Log Analytics workspace is the underlying storage, but the connection is made via data connectors. Option B is wrong because Azure Policy can enforce configuration but not directly ingest logs. Option C is wrong because Azure Monitor is a broader service; the specific connector is needed.

Answer

Configure a Log Analytics workspace to collect Activity Logs

Answer

Use Azure Policy to stream Activity Logs to Sentinel

Answer

Enable Azure Monitor to forward Activity Logs to Sentinel

Question 10

Refer to the exhibit. You are reviewing an Azure Policy definition. What does this policy do?

Accepted Answer

Denies creation of virtual machines that do not have a network interface attached. Option C is correct because the policy denies the creation of a virtual machine if the networkProfile.networkInterfaces field does not exist, meaning no NIC is attached. Option A is wrong because it denies creation, not deletes. Option B is wrong because it checks for NIC existence, not specific settings. Option D is wrong because it checks at creation time.

Answer

Audits virtual machines that have a network interface

Answer

Deletes virtual machines that do not have a network interface

Answer

Denies creation of virtual machines that have a network interface

Question 11

Refer to the exhibit. You run the PowerShell command shown in the exhibit. The command returns the secret value in plain text. The Key Vault has soft-delete and purge protection enabled. What is the most likely reason that the command succeeded?

Accepted Answer

The user has the 'Key Vault Secrets User' role assigned via RBAC. Option B is correct because the user running the command has the 'Key Vault Secrets User' role assigned, which includes the 'Microsoft.KeyVault/vaults/secrets/read' permission, allowing retrieval of secret values. Option A is wrong because the 'Secret Management' role in IAM does not exist. Option C is wrong because access policies are still used; the command uses the caller's identity. Option D is wrong because managed identity is not mentioned.

Answer

The Key Vault access policy allows the user to list secrets

Answer

The user has the 'Key Vault Secret Management' role in Azure RBAC

Answer

The command was executed using the Key Vault managed identity

Question 12

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

Retrieve details of security alerts named 'Suspicious process execution' from the last hour. Option A is correct because the query filters alerts with a specific name and time range, then projects selected fields. Option B is wrong because it does not aggregate. Option C is wrong because it does not join tables. Option D is wrong because it does not create a new rule.

Answer

Count the number of 'Suspicious process execution' alerts in the last hour

Answer

Join the SecurityAlert table with another table to enrich the results

Answer

Create an analytics rule to detect 'Suspicious process execution'

Question 13

Your organization is designing a data protection strategy using Microsoft Purview. You need to classify and label all sensitive data stored in Azure SQL Database. The solution must automatically detect credit card numbers and apply a sensitivity label. Which three actions should you take? (Choose three.)

Accepted Answer

Create a scan in Purview to classify sensitive data types. Options B, C, and D are correct because to automatically classify and label data in Azure SQL Database, you need to register the data source in Purview, scan it to discover sensitive data, and create an auto-labeling policy that applies the label. Option A is wrong because DLP policies are for data in use/motion, not for labeling. Option E is wrong because enabling auditing does not classify or label.

Answer

Enable Azure SQL Database auditing

Answer

Create a data loss prevention (DLP) policy in Purview

Question 14

You are designing a secure access strategy for Azure App Service web applications. The requirements are: use Azure AD for authentication, restrict access to specific IP ranges, and require multi-factor authentication (MFA) for all users. Which two components should you configure? (Choose two.)

Accepted Answer

Configure Azure App Service authentication with Microsoft Entra ID. Options B and C are correct because Azure App Service authentication can be configured to use Azure AD, and Conditional Access policies can enforce MFA and IP restrictions. Option A is wrong because app registration is part of the setup but not a direct component for access control. Option D is wrong because network security groups are for virtual networks, not App Service. Option E is wrong because Azure Firewall is for network traffic, not user authentication.

Answer

Apply a network security group (NSG) to the App Service subnet

Answer

Deploy Azure Firewall to filter inbound traffic

Answer

Register the application in Microsoft Entra ID

Question 15

Your organization uses Microsoft Defender for Cloud Apps. You need to detect and prevent the use of unsanctioned cloud apps. The solution should generate alerts when users access high-risk apps and block access to very high-risk apps. Which three actions should you take? (Choose three.)

Accepted Answer

Unsanction high-risk apps using the app catalog. Options A, C, and D are correct because to detect and block unsanctioned apps, you need to discover them via Cloud Discovery, sanction or unsanction them, and create policies to block unsanctioned apps. Option B is wrong because Conditional Access policies are for identity, not app blocking. Option E is wrong because DLP policies are for data protection, not app control.

Answer

Configure Conditional Access policies in Microsoft Entra ID to block unsanctioned apps

Answer

Create a DLP policy to prevent data upload to unsanctioned apps