SC-100 Design security solutions for applications and data Practice Test 2 — 15 Questions

Question 1

You are designing a data classification strategy for Microsoft Purview. The compliance team requires that documents containing personally identifiable information (PII) like credit card numbers are automatically labeled and encrypted when stored in Microsoft SharePoint Online. The solution must use built-in sensitive information types. What should you include in the design?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a sensitivity label with auto-labeling for credit card numbers and enable encryption. A sensitivity label with auto-labeling configured to detect sensitive information types like credit card numbers can automatically apply the label and encryption to documents in SharePoint Online. Option B is incorrect because retention labels manage data retention, not encryption. Option C is incorrect because trainable classifiers require custom training and are not built-in sensitive information types. Option D is incorrect because manual labeling requires user action and does not meet the automatic requirement.

Answer

Create a retention label and apply it automatically via a data loss prevention (DLP) policy

Answer

Use a trainable classifier to detect PII and apply a sensitivity label

Answer

Configure a manual sensitivity label policy for users to apply

Question 2

Your company uses Microsoft Defender for Cloud Apps to discover and control shadow IT. You need to block the use of a newly discovered unsanctioned cloud storage app that poses a high risk. What should you configure?

Accepted Answer

In Defender for Cloud Apps, unsanction the app and create a session policy to block it. Defender for Cloud Apps allows you to sanction/unsanction apps and create access policies to block unsanctioned apps. Option B is wrong because Conditional Access policies in Entra ID control access but not app blocking. Option C is wrong because Intune compliance policies manage device compliance. Option D is wrong because Defender for Cloud Apps can block apps directly.

Answer

Create a Conditional Access policy in Microsoft Entra ID to block the app

Answer

Use Microsoft Intune to set a compliance policy that blocks the app

Answer

Add the app to the blocked list in Microsoft Defender for Cloud Apps

Question 3

Your organization uses Microsoft Defender for Endpoint (MDE) for endpoint detection and response. You need to protect sensitive data on Windows 10 devices from being exfiltrated via USB drives. The solution must be able to audit file copy operations to USB and block them for high-risk users. What should you configure?

Accepted Answer

Deploy a device control policy in Microsoft Defender for Endpoint to audit USB usage and block for high-risk users. Microsoft Defender for Endpoint includes device control features that can audit and block removable storage. You can configure policies to audit all users and block for high-risk users using custom device control policies. Option A is wrong because Intune can manage USB restrictions but not with MDE-specific auditing. Option B is wrong because DLP policies in Microsoft Purview are for cloud and network. Option C is wrong because conditional access does not control USB.

Answer

Set up a Conditional Access policy in Microsoft Entra ID to block sign-ins from devices with USB activity

Answer

Use Microsoft Intune to create a device configuration profile that disables USB ports

Answer

Configure a Microsoft Purview DLP policy for endpoint devices

Question 4

You are designing a secure DevOps pipeline using GitHub Actions and Azure. The security team requires that all container images pushed to Azure Container Registry (ACR) are scanned for vulnerabilities before deployment. If critical vulnerabilities are found, the pipeline must fail. What should you integrate into the pipeline?

Accepted Answer

Integrate Microsoft Defender for Cloud with Azure Container Registry scanning and configure a GitHub Actions step to check scan results. Microsoft Defender for Cloud can scan container images in Azure Container Registry (ACR) for vulnerabilities and integrate with GitHub Actions. You can configure a GitHub Actions step to check the scan results and fail the pipeline if critical vulnerabilities are found. Option A is incorrect because Azure Policy can enforce compliance but cannot scan images for vulnerabilities. Option C is incorrect because Azure Bastion is for secure remote access to virtual machines, not for image scanning. Option D is incorrect because Azure Security Center (legacy) is now part of Microsoft Defender for Cloud, and the modern approach is to use Defender for Cloud's integrated scanning with ACR.

Answer

Configure Azure Policy to require image scanning before deployment

Answer

Deploy Azure Bastion to scan images during build

Answer

Use Azure Security Center (legacy) to scan images on push

Question 5

Your company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. You need to prevent users from sharing credit card numbers via email in Outlook on the web. The policy should notify users when they try to send such data and allow them to override with a business justification. What should you configure?

Accepted Answer

Create a DLP policy with the action 'Block with override' and enable 'Business justification'. It uses the 'Block with override' action and enables business justification, which meets the requirement to prevent sharing credit card numbers via email while allowing users to override with a justification. Option A is wrong because 'Audit only' only logs activity and does not block or notify users. Option C is wrong because encrypting the email does not prevent the sharing; it still allows sending but encrypts the content. Option D is wrong because 'Block' without override does not allow users to override with a business justification.

Answer

Create a DLP policy with the action 'Audit only' for credit card numbers

Answer

Create a DLP policy that encrypts emails containing credit card numbers

Answer

Create a DLP policy with the action 'Block' for credit card numbers

Question 6

You are designing a solution to protect Azure SQL Database from SQL injection attacks. The solution must use a web application firewall (WAF) and also ensure that queries from the application are parameterized. Which two components should you include? (Choose two. Each correct answer presents part of the solution.)

Accepted Answer

Azure Application Gateway with WAF. The correct components are Azure Application Gateway with WAF (Option C) and parameterized queries in application code (Option D). Azure Application Gateway with WAF can inspect and block SQL injection attempts at the network edge, while parameterized queries ensure that user input is treated as data, not executable code, preventing SQL injection at the application layer. Option A is incorrect because Azure SQL Database firewall rules control network access based on IP addresses, not application-layer attacks like SQL injection. Option B is incorrect because Transparent Data Encryption (TDE) encrypts data at rest, which does not prevent SQL injection attacks.

Answer

Azure SQL Database firewall rules

Answer

Transparent Data Encryption (TDE)

Question 7

Your organization is using Microsoft Sentinel for security information and event management (SIEM). You need to ensure that data from Azure Activity Logs is ingested into Sentinel. What should you configure?

Accepted Answer

Connect Azure Activity Logs via the Microsoft Sentinel data connector. You can connect Azure Activity Logs as a data connector in Microsoft Sentinel. Option A is wrong because Log Analytics workspace is the underlying storage, but the connection is made via data connectors. Option B is wrong because Azure Policy can enforce configuration but not directly ingest logs. Option C is wrong because Azure Monitor is a broader service; the specific connector is needed.

Answer

Configure a Log Analytics workspace to collect Activity Logs

Answer

Use Azure Policy to stream Activity Logs to Sentinel

Answer

Enable Azure Monitor to forward Activity Logs to Sentinel

Question 8

Refer to the exhibit. You are reviewing an Azure Policy definition. What does this policy do?

Accepted Answer

Denies creation of virtual machines that do not have a network interface attached. The policy denies creation of a virtual machine when the networkProfile.networkInterfaces field is missing or empty, indicating no NIC is attached. Option A is incorrect because the effect is 'deny', not 'audit'. Option B is incorrect because the action is denial at creation, not deletion. Option C is incorrect because it checks for absence of NIC, not presence.

Answer

Audits virtual machines that have a network interface

Answer

Deletes virtual machines that do not have a network interface

Answer

Denies creation of virtual machines that have a network interface

Question 9

Refer to the exhibit. You run the PowerShell command shown in the exhibit. The command returns the secret value in plain text. The Key Vault has soft-delete and purge protection enabled. What is the most likely reason that the command succeeded?

Accepted Answer

The user has the 'Key Vault Secrets User' role assigned via RBAC. The 'Key Vault Secrets User' role in Azure RBAC grants the 'Microsoft.KeyVault/vaults/secrets/read' permission, which allows the user to retrieve secret values in plain text. Option A is incorrect because an access policy that allows listing secrets does not necessarily allow reading secret values; reading requires the 'get' permission, not just 'list'. Option C is incorrect because there is no built-in role called 'Key Vault Secret Management'; the correct role for reading secrets is 'Key Vault Secrets User'. Option D is incorrect because the command was executed using the user's own identity, not a managed identity, as there is no indication of managed identity usage.

Answer

The Key Vault access policy allows the user to list secrets

Answer

The user has the 'Key Vault Secret Management' role in Azure RBAC

Answer

The command was executed using the Key Vault managed identity

Question 10

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

Retrieve details of security alerts named 'Suspicious process execution' from the last hour. The KQL query filters the SecurityAlert table for alerts with a specific name (e.g., 'Suspicious process execution') and within a specific time range (e.g., last 1h), then projects selected fields to retrieve details. Option A is incorrect because the query does not contain any aggregation (e.g., count) to count alerts. Option C is incorrect because the query does not include any join operation with another table. Option D is incorrect because the query only retrieves existing alerts; it does not create a new analytics rule.

Answer

Count the number of 'Suspicious process execution' alerts in the last hour

Answer

Join the SecurityAlert table with another table to enrich the results

Answer

Create an analytics rule to detect 'Suspicious process execution'

Question 11

Your organization is designing a data protection strategy using Microsoft Purview. You need to classify and label all sensitive data stored in Azure SQL Database. The solution must automatically detect credit card numbers and apply a sensitivity label. Which three actions should you take? (Choose three.)

Accepted Answer

Create a scan in Purview to classify sensitive data types. To automatically classify and label sensitive data in Azure SQL Database using Microsoft Purview, you need to: register the database as a data source in Purview (C), create a scan to discover sensitive data types like credit card numbers (B), and create a sensitivity label with auto-labeling for credit card numbers and publish it (E). Option A is incorrect because auditing logs database activity but does not classify or label data. Option D is incorrect because DLP policies are for preventing data loss in use/motion, not for automatic labeling.

Answer

Enable Azure SQL Database auditing

Answer

Create a data loss prevention (DLP) policy in Purview

Question 12

Your organization uses Microsoft Defender for Cloud Apps. You need to detect and prevent the use of unsanctioned cloud apps. The solution should generate alerts when users access high-risk apps and block access to very high-risk apps. Which three actions should you take? (Choose three.)

Accepted Answer

Unsanction high-risk apps using the app catalog. Options B, C, and D are correct. To detect and prevent the use of unsanctioned cloud apps in Microsoft Defender for Cloud Apps, you must first discover app usage through Cloud Discovery (D). Then, from the discovered apps, you can mark high-risk apps as unsanctioned using the app catalog (B). Finally, you create a session or access policy to block unsanctioned apps (C). Option A is incorrect because Conditional Access policies in Microsoft Entra ID are used for identity and access management, not to block unsanctioned cloud apps directly. Option E is incorrect because DLP policies focus on preventing data loss, not on controlling app access.

Answer

Configure Conditional Access policies in Microsoft Entra ID to block unsanctioned apps

Answer

Create a DLP policy to prevent data upload to unsanctioned apps

Question 13

A company uses Microsoft Defender for Cloud Apps to control data exfiltration from sanctioned SaaS apps. Security admins want to block downloading sensitive files from SharePoint Online to unmanaged devices. Which method should be used?

Accepted Answer

Create a session policy in Defender for Cloud Apps that checks for device tags and blocks download. Creating a session policy in Defender for Cloud Apps that checks for device tags is the correct approach because Defender for Cloud Apps can inspect device tags during a session and block downloads if the device is unmanaged. Option A is wrong because Conditional Access App Control is the underlying framework for session controls, not a specific policy type; the actual policy used is a session policy within Defender for Cloud Apps. Option C is wrong because Microsoft Purview DLP policies classify and protect data at rest or in transit, but they do not provide real-time session-level blocking within apps like SharePoint Online. Option D is wrong because Intune compliance policies enforce device compliance for enrollment, not session-level download control in SaaS apps.

Answer

Create a Conditional Access App Control session policy

Answer

Create a Microsoft Purview Data Loss Prevention policy for SharePoint

Answer

Create a Microsoft Intune compliance policy to block unmanaged devices

Question 14

Refer to the exhibit. A security architect is reviewing an ARM template for an Azure Key Vault. The vault must be accessible from a backend subnet via private endpoint. What is the missing configuration component?

Accepted Answer

Add a Microsoft.Network/privateEndpoints resource and a private DNS zone. The exhibit shows network ACLs with virtual network rules, but to use private endpoints, the template must include a private endpoint resource and a private DNS zone. Option B is correct because private endpoints are required for private connectivity, and they are not part of the vault resource itself. Option A is wrong because enabling RBAC authorization is not required for private endpoint access. Option C is wrong because a system-assigned managed identity is not needed for private endpoint connectivity. Option D is wrong because setting the defaultAction to Allow does not enable private endpoint connectivity; a separate private endpoint resource is required.

Answer

Enable RBAC authorization on the vault

Answer

Assign a system-assigned managed identity to the vault

Answer

Set the defaultAction to Allow for the network ACLs

Question 15

A company stores sensitive customer data in Azure SQL Database. They need to encrypt the data at rest and control access to encryption keys. Which solution should they use?

Accepted Answer

Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault. Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault provides at-rest encryption and allows the customer to control the encryption keys. Option A is wrong because Azure Information Protection is for classification and labeling, not database encryption. Option B is wrong because Always Encrypted encrypts data in use and at rest, but TDE is the standard for at-rest encryption. Option D is wrong because Dynamic Data Masking hides data from non-privileged users but does not encrypt at rest.

Answer

Azure Information Protection

Answer

Always Encrypted

Answer

Dynamic Data Masking