SC-100 Design security solutions for applications and data Practice Test 2 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud Apps. You need to detect and prevent the use of unsanctioned cloud apps. The solution should generate alerts when users access high-risk apps and block access to very high-risk apps. Which three actions should you take? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Unsanction high-risk apps using the app catalog. Option D is correct because Cloud Discovery in Defender for Cloud Apps is the foundational capability that analyzes traffic logs (from firewalls, proxies, or Defender for Endpoint) to identify which cloud apps users are accessing and assign them risk scores, which is required to detect unsanctioned app usage. Option B is correct because the app catalog lets you tag discovered apps with a sanction status; marking high-risk apps as 'unsanctioned' (i.e., not approved) is what drives alerting and downstream enforcement against them. Option C is correct because session and access policies in Defender for Cloud Apps (Conditional Access App Control) can block or restrict access to unsanctioned/very high-risk apps in real time, satisfying the requirement to block very high-risk apps. Option A is not correct because Conditional Access policies in Microsoft Entra ID control access to apps integrated with Entra ID, not to arbitrary unsanctioned cloud apps discovered via Cloud Discovery, so they cannot block shadow-IT apps. Option E is not correct because a DLP policy prevents data upload/exfiltration to unsanctioned apps but does not itself detect unsanctioned app usage or block access to very high-risk apps.

Answer

Configure Conditional Access policies in Microsoft Entra ID to block unsanctioned apps

Answer

Create a DLP policy to prevent data upload to unsanctioned apps

Question 2

A company uses Microsoft Defender for Cloud Apps to control data exfiltration from sanctioned SaaS apps. Security admins want to block downloading sensitive files from SharePoint Online to unmanaged devices. Which method should be used?

Accepted Answer

Create a session policy in Defender for Cloud Apps that checks for device tags and blocks download. Option B is correct because Defender for Cloud Apps session policies are the mechanism that enforces real-time control over sanctioned SaaS app sessions, and a session policy that evaluates device tags can block downloads specifically when the device is unmanaged. Device tags in Defender for Cloud Apps identify managed versus unmanaged devices, so a session policy using that condition directly blocks sensitive file downloads from SharePoint Online to unmanaged devices. Option A is not the right fit because Conditional Access App Control is the session-control capability itself, but the actual block of a download is defined through a Defender for Cloud Apps session policy, not by creating a Conditional Access App Control session policy. Option C is wrong because a Microsoft Purview DLP policy for SharePoint governs data handling and sharing but does not block downloads based on device management state in a Defender for Cloud Apps session. Option D is wrong because an Intune compliance policy evaluates device compliance and can restrict access via Conditional Access, but it does not perform the in-session download block required here.

Answer

Create a Conditional Access App Control session policy

Answer

Create a Microsoft Purview Data Loss Prevention policy for SharePoint

Answer

Create a Microsoft Intune compliance policy to block unmanaged devices

Question 3

Refer to the exhibit. A security architect is reviewing an ARM template for an Azure Key Vault. The vault must be accessible from a backend subnet via private endpoint. What is the missing configuration component?

Accepted Answer

Add a Microsoft.Network/privateEndpoints resource and a private DNS zone. The exhibit shows network ACLs with virtual network rules, but to use private endpoints, the template must include a private endpoint resource and a private DNS zone. Option B is correct because private endpoints are required for private connectivity, and they are not part of the vault resource itself. Option A is wrong because enabling RBAC authorization is not required for private endpoint access. Option C is wrong because a system-assigned managed identity is not needed for private endpoint connectivity. Option D is wrong because setting the defaultAction to Allow does not enable private endpoint connectivity; a separate private endpoint resource is required.

Answer

Enable RBAC authorization on the vault

Answer

Assign a system-assigned managed identity to the vault

Answer

Set the defaultAction to Allow for the network ACLs

Question 4

A company stores sensitive customer data in Azure SQL Database. They need to encrypt the data at rest and control access to encryption keys. Which solution should they use?

Accepted Answer

Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault. Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault provides at-rest encryption and allows the customer to control the encryption keys. Option A is wrong because Azure Information Protection is for classification and labeling, not database encryption. Option B is wrong because Always Encrypted encrypts data in use and at rest, but TDE is the standard for at-rest encryption. Option D is wrong because Dynamic Data Masking hides data from non-privileged users but does not encrypt at rest.

Answer

Azure Information Protection

Answer

Always Encrypted

Answer

Dynamic Data Masking

Question 5

A company deploys a line-of-business application on Azure App Service. The application uses a managed identity to access Azure SQL Database. Security policy requires that the database connection string must not contain credentials. How should the connection string be configured?

Accepted Answer

Use a managed identity and set the connection string to use Active Directory Managed Identity authentication without credentials. Using a managed identity, the connection string can be set to use 'Authentication=Active Directory Managed Identity' without any username or password. Option A is wrong because the connection string should not include credentials. Option B is wrong because Key Vault references are used for secrets, but managed identity itself avoids the need for a secret. Option D is wrong because connection strings are not stored in App Service as secrets.

Answer

Store the connection string in App Service application settings with the password encrypted by App Service

Answer

Store the connection string with username and password in Key Vault and reference it in App Settings

Answer

Store the connection string as a secret in Azure Key Vault and use a Key Vault reference in App Settings

Question 6

Refer to the exhibit. A security architect is reviewing a Microsoft Purview sensitivity label configuration for a financial services company. The compliance team requires that employees must provide justification when downgrading a document labeled 'Confidential - Financial' to 'General'. Which configuration is missing?

Accepted Answer

Configure the sublabel's protection settings to require justification for downgrade. The correct option is C: configuring the sublabel's protection settings to require justification for downgrade. In Microsoft Purview sensitivity labels, the requirement to provide a justification when a user lowers a label's classification is enforced through the label's protection settings, specifically the 'Require justification to remove or lower label' option, which must be enabled on the label being downgraded. Since the scenario demands justification when moving from 'Confidential - Financial' to 'General', that setting must be configured on the 'Confidential - Financial' label (or its protection settings), making C the missing configuration. Option A is irrelevant because creating a sublabel under 'General' does not enforce downgrade justification. Option B does not fit because auto-labeling applies labels automatically and does not govern manual downgrade justification. Option D is incorrect because label analytics only provides reporting and usage insights, not enforcement of justification prompts.

Answer

Create a new sublabel under 'General' to match the hierarchy

Answer

Configure auto-labeling for the sublabel

Answer

Enable label analytics in Purview

Question 7

A company uses Microsoft Entra ID for identity management. They want to ensure that only approved users can access a custom web application. The solution must support single sign-on (SSO) and require multi-factor authentication (MFA) for external users. Which approach should they use?

Accepted Answer

Configure Microsoft Entra B2B collaboration and set MFA trust settings. Microsoft Entra B2B collaboration is designed to onboard external (guest) users into the tenant, and its MFA trust settings let you enforce multi-factor authentication for those guests while they use SSO to access the custom web application. This directly satisfies the requirement that only approved external users get access with SSO and MFA. Option A enables SAML SSO but does not by itself govern external user onboarding or MFA for guests. Option B (Microsoft Entra application proxy) is for publishing on-premises apps to remote users, not for managing external user identity and MFA. Option D assigns app roles for authorization but does not provide the external-user collaboration or MFA enforcement required.

Answer

Register the application in Microsoft Entra ID and configure SAML-based sign-on

Answer

Use Azure AD Application Proxy to publish the app

Answer

Register the application in Microsoft Entra ID and assign app roles

Question 8

Your organization stores sensitive data in Azure Blob Storage. You need to ensure that data is encrypted at rest and that the encryption keys are rotated every 90 days. You also need to maintain your own key material. Which solution should you use?

Accepted Answer

Azure Storage Service Encryption with customer-managed keys in Azure Key Vault. Azure Storage Service Encryption with customer-managed keys in Azure Key Vault allows you to supply your own encryption keys and rotate them on your own schedule. Option A is wrong because Azure Information Protection is for classification and labeling, not encryption at rest. Option B is wrong because Azure Storage Service Encryption with Microsoft-managed keys does not allow customer control or rotation. Option D is wrong because Azure Disk Encryption is for VM disks, not Blob Storage.

Answer

Azure Information Protection

Answer

Azure Storage Service Encryption with Microsoft-managed keys

Answer

Azure Disk Encryption

Question 9

A company is designing a security solution for a new application that will be deployed on Azure Kubernetes Service (AKS). They need to protect secrets and ensure that only authorized pods can access them. Which TWO actions should they take? (Choose two.)

Accepted Answer

Enable pod identity to assign managed identities to pods for Key Vault access. Enable pod identity (Option A) to assign managed identities to pods, allowing them to authenticate to Azure Key Vault. Use Azure Key Vault Provider for Secrets Store CSI Driver (Option E) to mount secrets from Key Vault as volumes. Option B is incorrect because network policies control traffic, not secrets access. Option C is incorrect because ConfigMaps store secrets in plaintext, which is insecure. Option D is incorrect because Azure Disk Encryption protects disks, not secrets.

Answer

Configure network policies to restrict pod-to-pod traffic

Answer

Store secrets in Kubernetes ConfigMaps

Answer

Enable Azure Disk Encryption for AKS nodes

Question 10

A company is implementing Microsoft Purview to protect sensitive data in Microsoft 365. They need to prevent users from sharing credit card numbers via email. Which THREE components must be configured? (Choose three.)

Accepted Answer

Create a sensitive info type for credit card numbers. A sensitive info type for credit card numbers (Option C) is needed to detect the data. A DLP policy (Option D) enforces the rule. Policy tips (Option E) notify users about the policy. Option A is wrong because auto-labeling applies labels, but DLP policies are needed to block sharing. Option B is wrong because retention labels are for retention, not prevention.

Answer

Create an auto-labeling policy for credit card data

Answer

Create a retention label for credit card data

Question 11

A company uses Microsoft Defender for Cloud to secure their Azure workloads. They need to ensure that all Azure SQL databases have threat detection enabled. Which TWO actions should they take? (Choose two.)

Accepted Answer

Enable Azure Defender for SQL at the subscription level. Option B is correct because enabling Azure Defender for SQL at the subscription level turns on threat detection for all Azure SQL databases within that subscription, satisfying the requirement to cover every database without per-resource configuration. Option D is correct because enabling Advanced Threat Protection (the SQL threat detection feature) on each SQL server individually also activates threat detection for the databases hosted on those servers, which is the per-server equivalent of the subscription-level setting. Option A is incorrect because the 'SQL servers on machines' plan in Microsoft Defender for Cloud protects SQL Server instances running on Azure VMs and on-premises machines, not Azure SQL Database (PaaS). Option C is incorrect because SQL Vulnerability Assessment scans for misconfigurations and vulnerabilities; it does not provide threat detection. Option E is incorrect because SQL auditing records database events for compliance and forensic purposes but does not detect or alert on threats.

Answer

Enable Microsoft Defender for Cloud's 'SQL servers on machines' plan

Answer

Configure SQL Vulnerability Assessment

Answer

Configure SQL auditing on each database

Question 12

Your organization uses Microsoft Defender for Cloud Apps. You need to detect and prevent the use of unsanctioned cloud apps. The solution should generate alerts when users access high-risk apps and block access to very high-risk apps. Which three actions should you take? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Advanced Threat Protection on the SQL Server and configure email notifications for all databases.. The correct answer is A: enabling Advanced Threat Protection on the SQL Server and configuring email notifications for all databases. In Azure SQL, Advanced Threat Protection (ATP) is configured at the logical SQL Server level and automatically applies to all databases hosted on that server, so enabling it once on the server covers every Azure SQL Database and lets you specify the security team's email addresses for alerts. Option B is insufficient because an Azure Policy only audits and remediates configuration compliance; it does not itself enable ATP or send notifications. Option C is wrong because Threat Detection/ATP is not configured per individual database with email recipients in diagnostic settings—those settings control log export, not ATP alerts. Option D is wrong because Microsoft Sentinel is a SIEM that can ingest and correlate alerts, but it does not enable the underlying ATP feature or replace its native email notification configuration.

Answer

Create an Azure Policy to audit Threat Detection settings and remediate non-compliant databases.

Answer

Enable Threat Detection on each individual Azure SQL Database and set the email recipients in the server's diagnostic settings.

Answer

Configure Microsoft Sentinel to monitor Azure SQL Databases and trigger alerts.

Question 13

Your company is deploying Microsoft Entra ID for application authentication. You need to register a new web application that uses OAuth 2.0 for user sign-in. Which authentication flow should you use?

Accepted Answer

Authorization code flow. Authorization Code Flow is the recommended flow for web applications that have a backend server. Option A is wrong because Device Code Flow is meant for input-constrained devices. Option C is wrong because Implicit Flow is deprecated for user sign-in. Option D is wrong because Client Credentials Flow is used for server-to-server authentication without a user.

Answer

Device code flow

Answer

Implicit flow

Answer

Client credentials flow

Question 14

Your company uses Microsoft Intune for mobile device management. You need to ensure that corporate data on iOS devices is protected by requiring a PIN and encrypting the device. What configuration should you create?

Accepted Answer

Create a compliance policy that requires a device PIN and encryption.. A compliance policy in Intune defines device requirements like PIN and encryption. Option A is wrong because a device configuration profile can enforce settings but does not inherently enforce compliance; compliance policy is the standard way to require PIN and encryption. Option B is wrong because Conditional Access policies control access based on compliance, not enforce settings directly. Option D is wrong because app protection policies target apps, not device-level settings.

Answer

Create a device configuration profile to enforce PIN and encryption.

Answer

Create a Conditional Access policy that requires compliant devices.

Answer

Create an app protection policy for Microsoft apps.

Question 15

You are analyzing sign-in logs in Microsoft Sentinel. The query returns users with ResultType 50074. What does this result type indicate?

Accepted Answer

The user did not pass strong authentication.. ResultType 50074 indicates that strong authentication was required but the user did not pass it (e.g., MFA challenge failure or not performed). Option A is wrong because 50074 is not generic failure. Option C is wrong because 50074 is specific to strong authentication. Option D is wrong because it's not about conditional access policy, but authentication strength.

Answer

The user was blocked by a conditional access policy.

Answer

The user successfully signed in with MFA.

Answer

The user failed to sign in due to incorrect password.