SC-100 Design security solutions for applications and data Practice Test 3 — 15 Questions

Question 1

A company deploys a line-of-business application on Azure App Service. The application uses a managed identity to access Azure SQL Database. Security policy requires that the database connection string must not contain credentials. How should the connection string be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a managed identity and set the connection string to use Active Directory Managed Identity authentication without credentials. Using a managed identity, the connection string can be set to use 'Authentication=Active Directory Managed Identity' without any username or password. Option A is wrong because the connection string should not include credentials. Option B is wrong because Key Vault references are used for secrets, but managed identity itself avoids the need for a secret. Option D is wrong because connection strings are not stored in App Service as secrets.

Answer

Store the connection string in App Service application settings with the password encrypted by App Service

Answer

Store the connection string with username and password in Key Vault and reference it in App Settings

Answer

Store the connection string as a secret in Azure Key Vault and use a Key Vault reference in App Settings

Question 2

Refer to the exhibit. A security architect is reviewing a Microsoft Purview sensitivity label configuration for a financial services company. The compliance team requires that employees must provide justification when downgrading a document labeled 'Confidential - Financial' to 'General'. Which configuration is missing?

Accepted Answer

Configure the sublabel's protection settings to require justification for downgrade. To require justification when downgrading a sensitivity label, you must configure the label's protection settings. Specifically, in Microsoft Purview, under the label's configuration, there is a setting called 'Justification on downgrade' that must be enabled. Option C correctly describes this. Option A is incorrect because creating a new sublabel does not enforce justification. Option B is incorrect because auto-labeling applies labels automatically, but does not control downgrade actions. Option D is incorrect because label analytics provides reporting but does not enforce justification requirements.

Answer

Create a new sublabel under 'General' to match the hierarchy

Answer

Configure auto-labeling for the sublabel

Answer

Enable label analytics in Purview

Question 3

A company uses Microsoft Entra ID for identity management. They want to ensure that only approved users can access a custom web application. The solution must support single sign-on (SSO) and require multi-factor authentication (MFA) for external users. Which approach should they use?

Accepted Answer

Configure Microsoft Entra B2B collaboration and set MFA trust settings. Microsoft Entra B2B collaboration allows external users to sign in using their own identities, and by configuring MFA trust settings, the organization can rely on MFA performed by the external user's home tenant, fulfilling the requirement for MFA without requiring additional Conditional Access policies. Option A is wrong because SAML-based sign-on provides SSO but does not enforce MFA. Option B is wrong because Azure AD Application Proxy is designed to publish on-premises applications for remote access and does not itself enforce MFA for external users. Option D is wrong because app roles manage authorization (who can access the app), not authentication methods like MFA.

Answer

Register the application in Microsoft Entra ID and configure SAML-based sign-on

Answer

Use Azure AD Application Proxy to publish the app

Answer

Register the application in Microsoft Entra ID and assign app roles

Question 4

Your organization stores sensitive data in Azure Blob Storage. You need to ensure that data is encrypted at rest and that the encryption keys are rotated every 90 days. You also need to maintain your own key material. Which solution should you use?

Accepted Answer

Azure Storage Service Encryption with customer-managed keys in Azure Key Vault. Azure Storage Service Encryption with customer-managed keys in Azure Key Vault allows you to supply your own encryption keys and rotate them on your own schedule. Option A is wrong because Azure Information Protection is for classification and labeling, not encryption at rest. Option B is wrong because Azure Storage Service Encryption with Microsoft-managed keys does not allow customer control or rotation. Option D is wrong because Azure Disk Encryption is for VM disks, not Blob Storage.

Answer

Azure Information Protection

Answer

Azure Storage Service Encryption with Microsoft-managed keys

Answer

Azure Disk Encryption

Question 5

Refer to the exhibit. A security analyst is reviewing a Windows security event log from a domain controller. The event indicates an attempted logon failure. Which type of attack is most likely being attempted?

Accepted Answer

Brute-force password guessing attack. Event ID 4625 indicates a failed logon attempt. Logon Type 3 (Network) and the target account 'admin' with failure reason 'Unknown user name or bad password' suggest a brute-force password guessing attack against a privileged account. Option D is correct because repeated failed network logons for the same account are characteristic of brute-force attacks. Option A is incorrect because a Kerberos golden ticket attack would involve forged TGTs and generate events like 4768 or 4769, not 4625. Option B is incorrect because DCSync attacks replicate directory data and produce events such as 4662, not logon failures. Option C is incorrect because pass-the-hash attacks typically succeed on the first attempt using hashed credentials and would not generate multiple failure events.

Answer

Kerberos golden ticket attack

Answer

DCSync attack

Answer

Pass-the-hash attack

Question 6

A company is designing a security solution for a new application that will be deployed on Azure Kubernetes Service (AKS). They need to protect secrets and ensure that only authorized pods can access them. Which TWO actions should they take? (Choose two.)

Accepted Answer

Enable pod identity to assign managed identities to pods for Key Vault access. Enable pod identity (Option A) to assign managed identities to pods, allowing them to authenticate to Azure Key Vault. Use Azure Key Vault Provider for Secrets Store CSI Driver (Option E) to mount secrets from Key Vault as volumes. Option B is incorrect because network policies control traffic, not secrets access. Option C is incorrect because ConfigMaps store secrets in plaintext, which is insecure. Option D is incorrect because Azure Disk Encryption protects disks, not secrets.

Answer

Configure network policies to restrict pod-to-pod traffic

Answer

Store secrets in Kubernetes ConfigMaps

Answer

Enable Azure Disk Encryption for AKS nodes

Question 7

A company is implementing Microsoft Purview to protect sensitive data in Microsoft 365. They need to prevent users from sharing credit card numbers via email. Which THREE components must be configured? (Choose three.)

Accepted Answer

Create a sensitive info type for credit card numbers. A sensitive info type for credit card numbers (Option C) is needed to detect the data. A DLP policy (Option D) enforces the rule. Policy tips (Option E) notify users about the policy. Option A is wrong because auto-labeling applies labels, but DLP policies are needed to block sharing. Option B is wrong because retention labels are for retention, not prevention.

Answer

Create an auto-labeling policy for credit card data

Answer

Create a retention label for credit card data

Question 8

Refer to the exhibit. A security architect is reviewing an Azure Policy definition. What is the effect of this policy?

Accepted Answer

Denies creation or update of storage accounts that do not require HTTPS traffic. This Azure Policy definition uses the 'deny' effect. It checks if the resource type is 'Microsoft.Storage/storageAccounts' and if the property 'supportsHttpsTrafficOnly' is set to false. If both conditions are met, the policy denies the creation or update of the storage account. Therefore, the correct answer is C: 'Denies creation or update of storage accounts that do not require HTTPS traffic'. Option A is incorrect because the effect is 'deny', not 'modify'. Option B is incorrect because the effect is 'deny', not 'audit'. Option D is incorrect because the policy does not deploy a remediation task; it denies the request immediately.

Answer

Modifies storage accounts to enable HTTPS traffic only

Answer

Audits storage accounts that do not require HTTPS traffic

Answer

Deploys a remediation task to enable HTTPS traffic only

Question 9

A company uses Microsoft Sentinel for SIEM. They need to ensure that security events from Azure Active Directory (now Microsoft Entra ID) are ingested into Sentinel. Which data connector should they enable?

Accepted Answer

Microsoft Entra ID connector. The Microsoft Entra ID connector (Option A) is the correct data source for ingesting sign-in logs and audit logs from Entra ID into Microsoft Sentinel. Option B (Office 365 connector) is wrong because it ingests data from Exchange, SharePoint, etc., not Entra ID. Option C (Azure Activity connector) is wrong because it ingests subscription-level events, not identity logs. Option D (Microsoft Defender XDR connector) is wrong because it ingests alerts from Defender products, not Entra ID logs.

Answer

Office 365 connector

Answer

Azure Activity connector

Answer

Microsoft Defender XDR connector

Question 10

Refer to the exhibit. A security architect is reviewing the network configuration of an Azure App Service app named 'finance-app'. The app needs to be accessible from a backend subnet via private endpoint. Which additional configuration is required?

Accepted Answer

Create a private endpoint and associate it with the App Service. The exhibit shows that public network access is disabled and a virtual network rule is in place. However, to allow inbound traffic from the backend subnet via a private endpoint, the App Service must be associated with a private endpoint resource. Creating a private endpoint and linking it to the App Service provides a private IP address from the subnet, enabling secure inbound access without public exposure. Option A is incorrect because enabling publicNetworkAccess would expose the app to the internet, defeating the purpose. Option B is incorrect because regional VNet integration is for outbound traffic from the app, not inbound. Option D is incorrect because IP-based SSL is for custom domain SSL, not network connectivity.

Answer

Set publicNetworkAccess to Enabled

Answer

Configure regional VNet integration for the app

Answer

Enable IP-based SSL for the app

Question 11

A company uses Microsoft 365 and wants to protect sensitive documents from being shared externally. They need a solution that automatically classifies documents containing personally identifiable information (PII) and applies appropriate protection. Which two services should they combine?

Accepted Answer

Microsoft Purview Information Protection and Data Loss Prevention (DLP). Microsoft Purview Information Protection allows for classification and labeling of documents based on content, while Data Loss Prevention (DLP) policies can enforce actions such as blocking external sharing or applying encryption. Together, they provide automated protection for sensitive documents like those containing PII. Option D is correct because these two services work together to classify and protect documents. Option A is incorrect because Microsoft Defender for Cloud Apps focuses on SaaS app security and Intune is for device management; they do not directly classify documents. Option B is incorrect because Compliance Manager is for managing compliance posture, and Sentinel is a SIEM; they are not used for automatic document classification. Option C is incorrect because Azure Information Protection is a previous version, now part of Purview, and Microsoft Entra ID is an identity service; they do not provide the same integrated classification and DLP capabilities as the Purview solutions.

Answer

Microsoft Defender for Cloud Apps and Microsoft Intune

Answer

Microsoft Purview Compliance Manager and Microsoft Sentinel

Answer

Azure Information Protection and Microsoft Entra ID

Question 12

Your organization uses Microsoft Defender for Cloud to protect Azure workloads. You need to ensure that all Azure SQL Databases have Threat Detection enabled and Advanced Threat Protection notifications are sent to the security team. What should you do?

Accepted Answer

Enable Advanced Threat Protection on the SQL Server and configure email notifications for all databases.. Enabling Advanced Threat Protection on the SQL Server applies to all databases, including future ones, and allows configuring email notifications for the security team. This is the most efficient and comprehensive approach. Option B (Azure Policy) can audit settings but cannot directly configure notifications. Option C (enabling on each database individually) is inefficient and does not cover new databases automatically. Option D (Microsoft Sentinel) is not required for this basic notification setup.

Answer

Create an Azure Policy to audit Threat Detection settings and remediate non-compliant databases.

Answer

Enable Threat Detection on each individual Azure SQL Database and set the email recipients in the server's diagnostic settings.

Answer

Configure Microsoft Sentinel to monitor Azure SQL Databases and trigger alerts.

Question 13

Your company is deploying Microsoft Entra ID for application authentication. You need to register a new web application that uses OAuth 2.0 for user sign-in. Which authentication flow should you use?

Accepted Answer

Authorization code flow. Authorization Code Flow is the recommended flow for web applications that have a backend server. Option A is wrong because Device Code Flow is meant for input-constrained devices. Option C is wrong because Implicit Flow is deprecated for user sign-in. Option D is wrong because Client Credentials Flow is used for server-to-server authentication without a user.

Answer

Device code flow

Answer

Implicit flow

Answer

Client credentials flow

Question 14

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft Teams. You need to prevent users from sharing credit card numbers in Teams chat messages. However, the policy should allow sharing with external vendors if they are in your organization's approved list. What should you configure?

Accepted Answer

Configure a DLP policy with a condition to block sharing of credit card numbers to external users except those from approved domains.. You can configure a DLP policy in Microsoft Purview to block sensitive data like credit card numbers in Teams messages, and use the 'Block sharing to external users except' condition to allow sharing with approved domains. This meets the requirement to prevent sharing with unauthorized external users while allowing sharing with approved vendors. Option B is wrong because blocking all external sharing is too restrictive and does not allow the approved external vendors. Option C is wrong because Information Protection labels do not have the granular control over sharing conditions based on external domains. Option D is wrong because sensitivity labels are not designed for DLP actions such as blocking sharing in Teams chat based on external approval.

Answer

Create a DLP policy that blocks credit card numbers and set the action to 'Block external sharing' for all external users.

Answer

Use Microsoft Purview Information Protection to automatically apply a 'Confidential' label to messages containing credit card numbers and block forwarding.

Answer

Create a sensitivity label for credit card data and publish it to Teams, then configure auto-labeling.

Question 15

Your team develops a web application hosted on Azure App Service. You need to secure the application against common web vulnerabilities like SQL injection and cross-site scripting. What should you implement?

Accepted Answer

Enable Azure Web Application Firewall (WAF) on Azure Front Door or Application Gateway.. Azure Web Application Firewall (WAF) on Azure Front Door or Application Gateway protects against OWASP Top 10 threats, including SQL injection and cross-site scripting, at the application layer. Option B is incorrect because Key Vault manages secrets, not application-level attack prevention. Option C is incorrect because NSGs filter network traffic but do not inspect application payloads. Option D is incorrect because DDoS Protection mitigates network volumetric attacks, not application-layer vulnerabilities.

Answer

Store application secrets in Azure Key Vault and enable managed identity.

Answer

Configure Network Security Groups (NSGs) on the App Service subnet to restrict inbound traffic.

Answer

Enable Azure DDoS Protection on the virtual network.