SC-100 Design security solutions for applications and data Practice Test 3 — 15 Questions

Question 1

A company uses Microsoft Defender for Cloud Apps to control data exfiltration from sanctioned SaaS apps. Security admins want to block downloading sensitive files from SharePoint Online to unmanaged devices. Which method should be used?

Accepted Answer

Create a session policy in Defender for Cloud Apps that checks for device tags and blocks download. Session policy with device tag check is the correct approach because Defender for Cloud Apps can inspect device tags during a session and block downloads if the device is unmanaged. Option A is wrong because Conditional Access App Control is the underlying framework, not a specific policy type. Option B is wrong because DLP policies in Purview are for classification, not real-time blocking in apps. Option D is wrong because compliance policies are for device compliance, not session-level control.

Answer

Create a Conditional Access App Control session policy

Answer

Create a Microsoft Purview Data Loss Prevention policy for SharePoint

Answer

Create a Microsoft Intune compliance policy to block unmanaged devices

Question 2

Refer to the exhibit. A security architect is reviewing an ARM template for an Azure Key Vault. The vault must be accessible from a backend subnet via private endpoint. What is the missing configuration component?

Accepted Answer

Add a Microsoft.Network/privateEndpoints resource and a private DNS zone. The exhibit shows network ACLs with virtual network rules, but to use private endpoints, the template must include a private endpoint resource and a private DNS zone. Option B is correct because private endpoints are required for private connectivity, and they are not part of the vault resource itself. Option A is wrong because enabling RBAC authorization is not required for private endpoint access. Option C is wrong because disabling public network access is done via the network ACLs, but private endpoints still need a separate resource. Option D is wrong because a system-assigned managed identity is not needed for private endpoint connectivity.

Answer

Enable RBAC authorization on the vault

Answer

Assign a system-assigned managed identity to the vault

Answer

Set the defaultAction to Allow for the network ACLs

Question 3

A company stores sensitive customer data in Azure SQL Database. They need to encrypt the data at rest and control access to encryption keys. Which solution should they use?

Accepted Answer

Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault. Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault provides at-rest encryption and allows the customer to control the encryption keys. Option A is wrong because Dynamic Data Masking hides data from non-privileged users but does not encrypt at rest. Option B is wrong because Always Encrypted encrypts data in use and at rest, but TDE is the standard for at-rest encryption. Option D is wrong because Azure Information Protection is for classification and labeling, not database encryption.

Answer

Azure Information Protection

Answer

Always Encrypted

Answer

Dynamic Data Masking

Question 4

A company deploys a line-of-business application on Azure App Service. The application uses a managed identity to access Azure SQL Database. Security policy requires that the database connection string must not contain credentials. How should the connection string be configured?

Accepted Answer

Use a managed identity and set the connection string to use Active Directory Managed Identity authentication without credentials. Using a managed identity, the connection string can be set to use 'Authentication=Active Directory Managed Identity' without any username or password. Option A is wrong because the connection string should not include credentials. Option B is wrong because Key Vault references are used for secrets, but managed identity itself avoids the need for a secret. Option D is wrong because connection strings are not stored in App Service as secrets.

Answer

Store the connection string in App Service application settings with the password encrypted by App Service

Answer

Store the connection string with username and password in Key Vault and reference it in App Settings

Answer

Store the connection string as a secret in Azure Key Vault and use a Key Vault reference in App Settings

Question 5

Refer to the exhibit. A security architect is reviewing a Microsoft Purview sensitivity label configuration for a financial services company. The compliance team requires that employees must provide justification when downgrading a document labeled 'Confidential - Financial' to 'General'. Which configuration is missing?

Accepted Answer

Configure the sublabel's protection settings to require justification for downgrade. The exhibit shows a sensitivity label hierarchy but does not include any marking or protection settings. To require justification for downgrading, the label must have a conditional access policy or auto-labeling policy configured, specifically a 'justification on downgrade' setting. Option B is correct because justification is configured as part of the label's protection settings. Option A is wrong because auto-labeling is for automatic application, not downgrade control. Option C is wrong because label analytics is for reporting, not enforcement. Option D is wrong because the sublabel itself does not enforce justification.

Answer

Create a new sublabel under 'General' to match the hierarchy

Answer

Configure auto-labeling for the sublabel

Answer

Enable label analytics in Purview

Question 6

A company uses Microsoft Entra ID for identity management. They want to ensure that only approved users can access a custom web application. The solution must support single sign-on (SSO) and require multi-factor authentication (MFA) for external users. Which approach should they use?

Accepted Answer

Configure Microsoft Entra B2B collaboration and set MFA trust settings. Registering the application in Microsoft Entra ID and configuring Conditional Access policies to require MFA for external users provides SSO and MFA enforcement. Option A is wrong because SAML sign-on alone does not enforce MFA. Option B is wrong because app roles manage authorization, not authentication requirements. Option C is wrong because B2B collaboration handles identity, but MFA is enforced through Conditional Access, not solely through B2B settings.

Answer

Register the application in Microsoft Entra ID and configure SAML-based sign-on

Answer

Use Azure AD Application Proxy to publish the app

Answer

Register the application in Microsoft Entra ID and assign app roles

Question 7

Your organization stores sensitive data in Azure Blob Storage. You need to ensure that data is encrypted at rest and that the encryption keys are rotated every 90 days. You also need to maintain your own key material. Which solution should you use?

Accepted Answer

Azure Storage Service Encryption with customer-managed keys in Azure Key Vault. Azure Storage encryption with customer-managed keys in Azure Key Vault allows you to supply your own encryption keys and rotate them on your own schedule. Option A is wrong because Azure Disk Encryption is for VM disks, not Blob Storage. Option B is wrong because Azure Storage Service Encryption with Microsoft-managed keys does not allow customer control or rotation. Option D is wrong because Azure Information Protection is for classification and labeling, not encryption at rest.

Answer

Azure Information Protection

Answer

Azure Storage Service Encryption with Microsoft-managed keys

Answer

Azure Disk Encryption

Question 8

Refer to the exhibit. A security analyst is reviewing a Windows security event log from a domain controller. The event indicates an attempted logon failure. Which type of attack is most likely being attempted?

Accepted Answer

Brute-force password guessing attack. Event 4625 is a failed logon attempt. Logon Type 3 (Network) and the target account 'admin' with failure reason 'Unknown user name or bad password' suggest a brute-force or password guessing attack against a privileged account. Option B is correct because the event shows attempts to guess the 'admin' account password over the network. Option A is wrong because a pass-the-hash attack would use a different logon type and process. Option C is wrong because a Kerberos golden ticket attack would not show a logon type 3 failure. Option D is wrong because DCSync would generate different events (4662).

Answer

Kerberos golden ticket attack

Answer

DCSync attack

Answer

Pass-the-hash attack

Question 9

A company is designing a security solution for a new application that will be deployed on Azure Kubernetes Service (AKS). They need to protect secrets and ensure that only authorized pods can access them. Which TWO actions should they take? (Choose two.)

Accepted Answer

Enable pod identity to assign managed identities to pods for Key Vault access. Using Azure Key Vault Provider for Secrets Store CSI Driver (Option A) allows pods to mount secrets from Key Vault. Enabling pod identity with managed identity (Option C) ensures that only authorized pods can access Key Vault. Option B is wrong because storing secrets in ConfigMaps is not secure. Option D is wrong because Azure Disk Encryption does not apply to secrets. Option E is wrong because Network Policies control traffic, not secrets access.

Answer

Configure network policies to restrict pod-to-pod traffic

Answer

Store secrets in Kubernetes ConfigMaps

Answer

Enable Azure Disk Encryption for AKS nodes

Question 10

A company is implementing Microsoft Purview to protect sensitive data in Microsoft 365. They need to prevent users from sharing credit card numbers via email. Which THREE components must be configured? (Choose three.)

Accepted Answer

Create a sensitive info type for credit card numbers. A sensitive info type for credit card numbers (Option A) is needed to detect the data. A DLP policy (Option C) enforces the rule. A policy tip (Option E) notifies users about the policy. Option B is wrong because retention labels are for retention, not prevention. Option D is wrong because auto-labeling applies labels, but DLP policies are needed to block sharing.

Answer

Create an auto-labeling policy for credit card data

Answer

Create a retention label for credit card data

Question 11

A company uses Microsoft Defender for Cloud to secure their Azure workloads. They need to ensure that all Azure SQL databases have threat detection enabled. Which TWO actions should they take? (Choose two.)

Accepted Answer

Enable Microsoft Defender for Cloud's 'SQL servers on machines' plan. Enabling Azure Defender for SQL at the subscription level (Option A) automatically enables threat detection for all SQL databases. Option C is correct because Defender for Cloud can enable Microsoft Defender for SQL as a plan. Option B is wrong because enabling individual audit policies is not necessary for threat detection. Option D is wrong because Advanced Threat Protection is part of the Azure SQL security settings, but the plan is enabled at the subscription level. Option E is wrong because vulnerability assessment is a separate feature.

Answer

Configure SQL Vulnerability Assessment

Answer

Enable Advanced Threat Protection on each SQL server individually

Answer

Configure SQL auditing on each database

Question 12

Refer to the exhibit. A security architect is reviewing an Azure Policy definition. What is the effect of this policy?

Accepted Answer

Denies creation or update of storage accounts that do not require HTTPS traffic. The policy checks if the resource type is a storage account and if HTTPS traffic only is set to false. If both conditions are true, it denies the creation or update of the storage account. Option B is correct because the effect is 'deny'. Option A is wrong because it does not audit; it denies. Option C is wrong because it does not modify; it denies. Option D is wrong because it does not deploy a remediation task.

Answer

Modifies storage accounts to enable HTTPS traffic only

Answer

Audits storage accounts that do not require HTTPS traffic

Answer

Deploys a remediation task to enable HTTPS traffic only

Question 13

A company uses Microsoft Sentinel for SIEM. They need to ensure that security events from Azure Active Directory (now Microsoft Entra ID) are ingested into Sentinel. Which data connector should they enable?

Accepted Answer

Microsoft Entra ID connector. The Microsoft Entra ID connector (Option B) is the correct data source for ingesting sign-in logs and audit logs from Entra ID. Option A is wrong because the Office 365 connector ingests data from Exchange, SharePoint, etc. Option C is wrong because the Azure Activity connector ingests subscription-level events. Option D is wrong because the Microsoft Defender XDR connector ingests alerts from Defender products.

Answer

Office 365 connector

Answer

Azure Activity connector

Answer

Microsoft Defender XDR connector

Question 14

Refer to the exhibit. A security architect is reviewing the network configuration of an Azure App Service app named 'finance-app'. The app needs to be accessible from a backend subnet via private endpoint. Which additional configuration is required?

Accepted Answer

Create a private endpoint and associate it with the App Service. The exhibit shows network ACLs with a virtual network rule allowing traffic from a subnet. However, to use private endpoint, the app must be integrated with a private endpoint resource. The 'publicNetworkAccess' is disabled, but private endpoint access requires a private endpoint resource to be created and associated with the app. Option A is correct. Option B is wrong because IP-based SSL is unrelated to network access. Option C is wrong because a regional VNet integration provides outbound connectivity, not inbound private access. Option D is wrong because enabling public access would defeat the purpose of private endpoint.

Answer

Set publicNetworkAccess to Enabled

Answer

Configure regional VNet integration for the app

Answer

Enable IP-based SSL for the app

Question 15

A company uses Microsoft 365 and wants to protect sensitive documents from being shared externally. They need a solution that automatically classifies documents containing personally identifiable information (PII) and applies appropriate protection. Which two services should they combine?

Accepted Answer

Microsoft Purview Information Protection and Data Loss Prevention (DLP). Microsoft Purview Information Protection provides classification and labeling, while Data Loss Prevention (DLP) enforces protection actions. Option A is correct because these two services work together to automatically classify and protect documents. Option B is wrong because Microsoft Defender for Cloud Apps is for SaaS app security, not primarily for document classification. Option C is wrong because Azure Information Protection is the predecessor, now part of Purview. Option D is wrong because Microsoft Entra ID is for identity, not document classification.

Answer

Microsoft Defender for Cloud Apps and Microsoft Intune

Answer

Microsoft Purview Compliance Manager and Microsoft Sentinel

Answer

Azure Information Protection and Microsoft Entra ID