SC-100 Design security solutions for applications and data Practice Test 3 — 15 Questions

Question 1

You run the PowerShell command to retrieve the vulnerability assessment baseline for rule VA2108 on an Azure SQL Database. The command returns a baseline with multiple rows. What is the purpose of this baseline?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It defines the expected scan result for rule VA2108, so future scans do not flag the same findings.. Vulnerability assessment baselines define acceptable scan results for specific rules, so that future scans do not report the same findings as vulnerabilities. Option A is wrong because baselines do not fix vulnerabilities. Option B is wrong because the baseline is for a specific database, not all databases. Option C is wrong because baselines are not about performance.

Answer

It configures the database to ignore performance issues related to rule VA2108.

Answer

It sets the baseline for all databases on the server for rule VA2108.

Answer

It automatically remediates the vulnerability identified by rule VA2108.

Question 2

Your company is using Microsoft Defender for Cloud to protect Azure resources. You need to implement just-in-time (JIT) VM access. Which THREE components are required? (Choose THREE.)

Accepted Answer

Microsoft Defender for Cloud enabled at the subscription level.. Options A, B, and E are required. JIT requires a VM with a network security group (NSG), enabling JIT in Defender for Cloud, and assigning permissions to request access. Option C is wrong because a Log Analytics workspace is not required. Option D is wrong because an Azure Bastion host is optional.

Answer

Log Analytics workspace for storing access logs.

Answer

Azure Bastion host for secure RDP/SSH access.

Question 3

A multinational corporation uses Microsoft Purview to classify and protect sensitive data. They need to ensure that any email containing a patient health record (PHI) is encrypted before delivery. Which capability should they use?

Accepted Answer

Microsoft Purview Message Encryption. Microsoft Purview Message Encryption is the correct capability because it encrypts email messages, including those containing PHI, before delivery and allows recipients to authenticate and read them even outside the organization. It applies encryption at the message level based on mail flow rules or policies, directly satisfying the requirement that any email with a patient health record be encrypted before delivery. A DLP policy can detect and block or warn about sensitive content but does not itself encrypt the email in transit. A sensitivity label with encryption is primarily for documents and can encrypt email, but the scenario specifically asks for a delivery-time email encryption capability, which Message Encryption provides. Azure Information Protection is a legacy/related labeling and protection service, not the dedicated email encryption feature for this requirement.

Answer

Data Loss Prevention (DLP) policy

Answer

Sensitivity label with encryption

Answer

Azure Information Protection

Question 4

An organization is using Microsoft Defender for Cloud to secure their Azure workloads. They have several Azure SQL databases that store sensitive financial data. The security team wants to receive alerts when a user attempts to access the database from a suspicious IP address or at an unusual time. Which Defender for Cloud plan provides this capability?

Accepted Answer

Defender for SQL. Defender for Cloud includes Defender for SQL, which provides anomalous activity detection for Azure SQL databases, including alerts for suspicious IP addresses or unusual access times. Option A is correct because Defender for SQL specifically covers these capabilities. Option B is wrong because Defender for Databases is a broader plan that includes multiple database types, but the specific feature for SQL is under Defender for SQL. Option C is wrong because 'Defender for Cloud SQL' is not a valid plan name; the correct plan is Defender for SQL. Option D is wrong because Microsoft Sentinel is a SIEM solution, not a built-in database protection service within Defender for Cloud.

Answer

Defender for Databases

Answer

Defender for Cloud SQL

Answer

Microsoft Sentinel

Question 5

A company is developing a web API that will be consumed by partner applications. They need to secure the API using OAuth 2.0 and issue access tokens that expire after 1 hour. Which Microsoft Entra ID feature should they use?

Accepted Answer

App registration. Microsoft Entra ID (formerly Azure AD) provides OAuth 2.0 token issuance through app registrations. Option B is correct. Option A (Managed Identity) is wrong because it is used for Azure resources to authenticate without credentials, not for issuing tokens to partner apps. Option C (Conditional Access) is wrong because it enforces access policies, not token issuance. Option D (Azure AD B2C) is wrong because it is designed for customer identity and access management, not for partner application scenarios.

Answer

Managed Identity

Answer

Conditional Access

Answer

Azure AD B2C

Question 6

A company is designing a data classification strategy using Microsoft Purview. They need to automatically classify and protect sensitive data stored in Azure Blob Storage. Which TWO capabilities should they use? (Choose TWO.)

Accepted Answer

Sensitivity labels. Sensitivity labels (A) are the correct capability because Microsoft Purview sensitivity labels can be applied to Azure Blob Storage containers and files, enabling automatic classification and protection (encryption, access restrictions) of sensitive data at rest. The Microsoft Purview Data Map (D) is also correct because it is the foundational service that scans and automatically discovers and classifies sensitive data across Azure Blob Storage using built-in or custom classifiers, feeding that classification into the rest of Purview. DLP policies (B) are not the right fit here because they primarily govern data in motion or in use (e.g., Exchange, SharePoint, endpoints) rather than providing the classification/protection mechanism for data at rest in Blob Storage. Information Barriers (C) are used to restrict communication and collaboration between specific groups in Microsoft 365, not to classify or protect Blob Storage data. Azure Policy (E) enforces resource governance and compliance rules on Azure resources but does not perform data classification or protection of sensitive content.

Answer

Data Loss Prevention (DLP) policies

Answer

Information Barriers

Answer

Azure Policy

Question 7

A financial services company uses Microsoft Sentinel for SIEM. They need to detect potential data exfiltration from their Azure SQL Database. Which THREE data sources should they connect to Sentinel to achieve this? (Choose THREE.)

Accepted Answer

Azure Network Watcher NSG flow logs. Azure SQL Database audit logs (D) are essential because they record the actual T-SQL statements and data access events (SELECT, BULK INSERT, etc.) against the database, which is the primary telemetry for spotting anomalous queries indicative of exfiltration. Azure Activity Logs (E) capture control-plane operations such as firewall rule changes, database exports, or 'Export to Storage' actions that attackers often use to move data out of Azure SQL. Azure Network Watcher NSG flow logs (C) provide IP-level traffic metadata (source/destination, port, bytes) that can reveal large outbound transfers from the SQL subnet to external or unexpected destinations. The other options are not marked correct: Defender for Cloud alerts (A) are security posture/recommendation alerts rather than raw SQL data-access telemetry, and Microsoft Entra ID sign-in logs (B) cover authentication events for identities, not database query or network exfiltration activity.

Answer

Microsoft Defender for Cloud alerts

Answer

Azure AD sign-in logs

Question 8

A company uses Microsoft Defender XDR (formerly Microsoft 365 Defender) to protect their Microsoft 365 environment. They want to ensure that sensitive data is not leaked through Microsoft Teams messages. Which TWO capabilities should they use? (Choose TWO.)

Accepted Answer

Data Loss Prevention (DLP) policies. Data Loss Prevention (DLP) policies (A) are correct because Microsoft Purview DLP for Teams inspects chat and channel messages for sensitive information types and blocks or warns on sharing sensitive data, directly preventing leakage through Teams messages. Communication Compliance (D) is also correct because it detects, captures, and reviews potentially inappropriate or sensitive communications in Teams (and other channels) using trainable classifiers and sensitive info types, enabling investigation and remediation of data-leak risks. Information Barriers (B) is not selected because it restricts which users or groups can communicate with each other rather than detecting or blocking sensitive data content. Sensitivity labels (C) are not selected because they classify and protect content (encryption, markings) but do not by themselves block sensitive data from being sent in Teams messages. Retention policies (E) are not selected because they govern how long content is kept or deleted, not the prevention of data leakage.

Answer

Information Barriers

Answer

Sensitivity labels

Answer

Retention policies

Question 9

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel to find high-risk sign-ins. The query returns no results, but they know there were high-risk sign-ins. What is the most likely reason?

Accepted Answer

The value 'high' should be 'High' (capitalized). The correct answer is A: the value 'high' should be 'High' (capitalized). In Microsoft Sentinel's SigninLogs table, the RiskLevelDuringSignIn and RiskLevelAggregated columns store values as capitalized strings such as 'High', 'Medium', 'Low', and 'None', so a filter like RiskLevelDuringSignIn == 'high' matches nothing due to case sensitivity in KQL string comparisons. Changing the literal to 'High' makes the query return the expected high-risk sign-ins. Option B is wrong because KQL uses == for equality, not a single equals sign. Option C is wrong because the field name in SigninLogs is RiskLevelDuringSignIn (or RiskLevelAggregated), not 'RiskLevel'. Option D is wrong because the time range is not the cause of zero results if high-risk sign-ins occurred within the queried window.

Answer

The query uses double equals instead of single equals

Answer

The field name is incorrect; it should be 'RiskLevel'

Answer

The time range should be 'ago(7d)'

Question 10

Your company is migrating a legacy on-premises web application to Azure App Service. The application uses Windows Integrated Authentication and connects to a SQL Server database. You need to design a security solution that minimizes changes to the application code while ensuring secure authentication and data protection. What should you use to authenticate users?

Accepted Answer

Microsoft Entra Application Proxy. Microsoft Entra Application Proxy (option A) is correct because it allows the legacy on-premises web application to keep using Windows Integrated Authentication (Kerberos/Negotiate) while publishing it securely to remote users through Entra ID, requiring no application code changes. It performs pre-authentication in Entra ID and then delegates to the on-premises Kerberos-constrained delegation, preserving the existing authentication model. Option B (Microsoft Entra Domain Services) provides managed domain services in Azure but would require domain-joining and reworking the app's authentication, and it does not by itself publish an on-premises app. Option C (App Service Authentication/EasyAuth with Entra ID) changes the authentication flow to Entra ID tokens and typically requires code/config changes, not Windows Integrated Authentication. Option D (Site-to-Site VPN with on-premises Active Directory) only provides network connectivity and does not deliver a secure user authentication solution for the migrated app.

Answer

Microsoft Entra Domain Services

Answer

App Service Authentication (EasyAuth) with Entra ID

Answer

Site-to-Site VPN with on-premises Active Directory

Question 11

Your organization is designing a data protection strategy for Microsoft 365 using Microsoft Purview. You need to protect sensitive data from being shared externally via email. Which TWO capabilities should you include?

Accepted Answer

Sensitivity labels with encryption for emails and attachments. Sensitivity labels with encryption (A) are correct because they let you classify emails and attachments and apply Azure Rights Management (Azure RMS) encryption so only authorized recipients can open the content, directly preventing external sharing of sensitive data. Data Loss Prevention (DLP) policies (C) are correct because they detect sensitive information types (for example, credit card or national ID numbers) in Exchange Online email and can block, encrypt, or restrict external sharing, which is the core requirement of stopping sensitive data from leaving via email. Retention labels and policies (B) only govern how long content is kept or deleted and do not prevent external sharing, so they do not meet the requirement. Microsoft Purview Message Encryption (D) is a related encryption feature but is not marked correct here because the scenario calls for the two capabilities that classify/protect and detect/block external email sharing. Privileged Access Management (E) restricts access to privileged administrative tasks in Microsoft 365, not the sharing of sensitive data in email, so it is out of scope.

Answer

Retention labels and policies

Answer

Microsoft Purview Message Encryption

Answer

Privileged Access Management (PAM)

Question 12

A company deploys a multi-tier application on Azure Kubernetes Service (AKS). The application uses Azure Key Vault to store secrets. You need to ensure that pod-level access to secrets is restricted to only the pods that require them. What should you implement?

Accepted Answer

Use the AKS Secret Store CSI Driver with pod-managed identities. The correct option is D: Use the AKS Secret Store CSI Driver with pod-managed identities. The Secret Store CSI Driver mounts Key Vault secrets directly into the pod's filesystem via a CSI volume, and with pod-managed identities (or workload identity), each pod authenticates with its own identity, so Key Vault access can be scoped to only the pods that need specific secrets. Option A is less precise because a managed identity alone does not provide the CSI-based secret mounting and per-pod scoping mechanism described. Option B applies Azure RBAC at the Key Vault or cluster level, which is too broad and does not restrict access to individual pods. Option C uses Azure Policy to deny access by namespace, but Azure Policy is a governance control and does not grant or scope runtime secret access per pod.

Answer

Use a managed identity for each pod to access Key Vault directly

Answer

Configure Azure RBAC on the Key Vault to restrict access to the AKS cluster

Answer

Apply Azure Policy to deny access to Key Vault from unauthorized namespaces

Question 13

Your company develops an API that will be consumed by external partners. You need to secure the API using Azure API Management (APIM). Which authentication mechanism should you recommend for partner applications?

Accepted Answer

OAuth 2.0 with Microsoft Entra ID. OAuth 2.0 with Microsoft Entra ID is the standard for delegated access and is suitable for partner applications. Option A is wrong because client certificates are typically used for server-to-server authentication and not ideal for partner apps. Option B is wrong because subscription keys are for identification, not authentication. Option D is wrong because IP whitelisting is network-level and not secure for authentication.

Answer

Client certificates

Answer

Subscription keys

Answer

IP address whitelisting

Question 14

Refer to the exhibit. You are reviewing an Azure Policy definition for storage accounts. You assign this policy with effect set to 'Deny' on a resource group. Which of the following scenarios will be blocked by this policy?

Accepted Answer

Creating a storage account with blob service encryption disabled. The Azure Policy definition in the exhibit enforces that blob service encryption must be enabled, so with the effect set to 'Deny', any attempt to create a storage account where blob service encryption is disabled will be blocked. The Deny effect prevents non-compliant resource creation at the resource group scope, and disabling blob service encryption directly violates the policy's condition. Option A does not fit because restricting public access via firewall settings is a separate control and does not violate an encryption-based policy. Option B does not fit because TLS 1.0 enforcement relates to the minimum TLS version property, not blob service encryption. Option D does not fit because infrastructure encryption is a distinct setting from blob service encryption and would not trigger this specific policy.

Answer

Creating a storage account with a firewall set to deny all public access

Answer

Creating a storage account with TLS 1.0 enabled

Answer

Creating a storage account with infrastructure encryption disabled

Question 15

Your company uses Microsoft 365 and wants to prevent sensitive data from being copied to personal cloud storage services like Dropbox. Which TWO Microsoft Purview capabilities should you use?

Accepted Answer

Data Loss Prevention (DLP) policies in Microsoft Purview. Option A, Data Loss Prevention (DLP) policies in Microsoft Purview, is correct because DLP policies can detect sensitive information types and block or restrict their sharing to unapproved cloud services, including personal cloud storage, when the activity is visible to the service (for example, in Exchange Online, SharePoint, OneDrive, or Teams). Option B, Endpoint Data Loss Prevention (Endpoint DLP), is correct because it extends DLP enforcement to Windows and macOS devices, allowing you to block copying sensitive files to personal cloud storage services like Dropbox from the endpoint itself, which is exactly the scenario described. Option C, the Azure Information Protection unified labeling client, is not correct because it is used for applying and consuming sensitivity labels and encryption, not for blocking data transfers to cloud services. Option D, Sensitivity labels, is not correct because labels classify and protect content (for example, with encryption or content marking) but do not by themselves prevent copying to personal cloud storage. Option E, Microsoft Defender for Cloud Apps, is not correct here because although it can discover and govern cloud app usage, the question asks for Microsoft Purview capabilities, and the two marked answers are the Purview DLP mechanisms that directly prevent the described data movement.

Answer

Azure Information Protection (AIP) unified labeling client

Answer

Sensitivity labels

Answer

Microsoft Defender for Cloud Apps (formerly Cloud App Security)