SC-100 Design security solutions for applications and data Practice Test 4 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to protect Azure workloads. You need to ensure that all Azure SQL Databases have Threat Detection enabled and Advanced Threat Protection notifications are sent to the security team. What should you do?

Accepted Answer

Enable Advanced Threat Protection on the SQL Server and configure email notifications for all databases.. Option C is correct because the SQL Server's Defender for Cloud settings include an option to enable Advanced Threat Protection for all databases and configure email notifications. Option A is wrong because Azure Policy can enforce settings but doesn't configure notifications directly. Option B is wrong because Microsoft Sentinel setup is not required for this. Option D is wrong because enabling at the database level is less efficient and doesn't cover new databases.

Answer

Create an Azure Policy to audit Threat Detection settings and remediate non-compliant databases.

Answer

Enable Threat Detection on each individual Azure SQL Database and set the email recipients in the server's diagnostic settings.

Answer

Configure Microsoft Sentinel to monitor Azure SQL Databases and trigger alerts.

Question 2

Your company is deploying Microsoft Entra ID for application authentication. You need to register a new web application that uses OAuth 2.0 for user sign-in. Which authentication flow should you use?

Accepted Answer

Authorization code flow. Option B is correct because Authorization Code Flow is the recommended flow for web applications that have a backend server. Option A is wrong because Implicit Flow is deprecated for user sign-in. Option C is wrong because Client Credentials Flow is for server-to-server without user. Option D is wrong because Device Code Flow is for input-constrained devices.

Answer

Device code flow

Answer

Implicit flow

Answer

Client credentials flow

Question 3

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft Teams. You need to prevent users from sharing credit card numbers in Teams chat messages. However, the policy should allow sharing with external vendors if they are in your organization's approved list. What should you configure?

Accepted Answer

Configure a DLP policy with a condition to block sharing of credit card numbers to external users except those from approved domains.. Option D is correct because DLP policies for Teams can use conditions to restrict sharing to specific domains or approved external organizations. Option A is wrong because blocking all external sharing is too restrictive. Option B is wrong because sensitivity labels are separate from DLP and not designed for this granular condition. Option C is wrong because labels can't directly control sharing in Teams chat based on external party approval.

Answer

Create a DLP policy that blocks credit card numbers and set the action to 'Block external sharing' for all external users.

Answer

Use Microsoft Purview Information Protection to automatically apply a 'Confidential' label to messages containing credit card numbers and block forwarding.

Answer

Create a sensitivity label for credit card data and publish it to Teams, then configure auto-labeling.

Question 4

Your team develops a web application hosted on Azure App Service. You need to secure the application against common web vulnerabilities like SQL injection and cross-site scripting. What should you implement?

Accepted Answer

Enable Azure Web Application Firewall (WAF) on Azure Front Door or Application Gateway.. Option C is correct because Azure Web Application Firewall (WAF) on Azure Front Door or Application Gateway protects against OWASP Top 10 threats including SQL injection and XSS. Option A is wrong because NSGs protect network traffic, not application layer. Option B is wrong because Key Vault is for secrets. Option D is wrong because DDoS protection is for network layer attacks.

Answer

Store application secrets in Azure Key Vault and enable managed identity.

Answer

Configure Network Security Groups (NSGs) on the App Service subnet to restrict inbound traffic.

Answer

Enable Azure DDoS Protection on the virtual network.

Question 5

Your organization uses Microsoft Sentinel to detect threats. You need to design a solution that automatically remediates a detected threat on an Azure VM by isolating the VM from the network. What should you use?

Accepted Answer

Create a Microsoft Sentinel automation rule that triggers a playbook to run an Azure Automation runbook to modify the NSG.. Option A is correct because Microsoft Sentinel can trigger a playbook (automation rule) that runs an Azure Automation runbook to modify the NSG and isolate the VM. Option B is wrong because Log Analytics workspace doesn't have remediation actions. Option C is wrong because Azure Policy is for compliance, not incident response. Option D is wrong because Defender for Cloud has some automation, but Sentinel playbook is the designed method for automated response.

Answer

Configure a Log Analytics workspace query to run on a schedule and automatically block the VM.

Answer

Use Azure Policy to audit and automatically remediate non-compliant VMs.

Answer

Enable Microsoft Defender for Cloud's 'Just-in-time VM access' policy.

Question 6

Your company uses Microsoft Intune for mobile device management. You need to ensure that corporate data on iOS devices is protected by requiring a PIN and encrypting the device. What configuration should you create?

Accepted Answer

Create a compliance policy that requires a device PIN and encryption.. Option C is correct because a compliance policy in Intune defines device requirements like PIN and encryption. Option A is wrong because app protection policies target apps, not device-level settings. Option B is wrong because device configuration profiles can enforce settings but compliance policy is the standard way to require PIN and encryption for compliance. Option D is wrong because Conditional Access policies control access based on compliance, not enforce settings directly.

Answer

Create a device configuration profile to enforce PIN and encryption.

Answer

Create a Conditional Access policy that requires compliant devices.

Answer

Create an app protection policy for Microsoft apps.

Question 7

Your organization is deploying Microsoft Defender for Cloud Apps. You need to create a policy that blocks downloads of sensitive files from sanctioned cloud apps to unmanaged devices. What type of policy should you create?

Accepted Answer

Session policy. Option B is correct because Session policies in Defender for Cloud Apps can monitor and control user sessions in real-time, including blocking downloads based on device tags. Option A is wrong because access policies control access but not session-level actions like downloads. Option C is wrong because app discovery policies are for discovering shadow IT. Option D is wrong because anomaly detection policies detect unusual behavior, not block downloads.

Answer

App discovery policy

Answer

Anomaly detection policy

Answer

Access policy

Question 8

Your organization uses Azure API Management (APIM) to expose APIs to external partners. You need to ensure that only authorized partners can access the APIs and that the API requests are rate-limited to prevent abuse. What should you implement?

Accepted Answer

Use a validate JWT policy to authenticate partners and a rate-limit by key policy to control request rates.. Option D is correct because APIM policies can validate JWT tokens for authorization and use rate limiting policy to control request rates. Option A is wrong because subscription keys alone are not secure for partner authentication. Option B is wrong because OAuth 2.0 with API keys is not standard; APIM supports OAuth via policies. Option C is wrong because Client certificates are another method but not combined with rate limiting as effectively as policy.

Answer

Configure client certificate authentication and set a global rate limit in the APIM service.

Answer

Require a subscription key for each partner and configure IP whitelisting.

Answer

Use OAuth 2.0 tokens and store partner API keys in Azure Key Vault.

Question 9

Your organization uses Microsoft Purview to govern data assets across Azure and on-premises. You need to automatically classify sensitive data such as credit card numbers in Azure SQL Database. What should you use?

Accepted Answer

Microsoft Purview Data Map. Option B is correct because Microsoft Purview Data Map can scan Azure SQL Database and apply automatic classification using built-in classifiers. Option A is wrong because Microsoft Sentinel is for SIEM, not data classification. Option C is wrong because Microsoft Defender for Cloud is for security posture, not data classification. Option D is wrong because Microsoft Entra ID is for identity.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Entra ID

Answer

Microsoft Sentinel

Question 10

You are reviewing the ARM template snippet for an Azure Storage container. What does the 'denyEncryptionScopeOverride' property set to 'true' ensure?

Accepted Answer

Users cannot override the default encryption scope for blobs in this container.. Option A is correct because when 'denyEncryptionScopeOverride' is true, all blobs in the container must use the default encryption scope and cannot specify a different scope. Option B is wrong because it is about enforcing default scope, not requiring customer-managed keys. Option C is wrong because encryption at rest is always enabled; this setting controls scope override. Option D is wrong because it doesn't affect double encryption.

Answer

Double encryption is enabled for the container.

Answer

Encryption at rest is required for all blobs in the container.

Answer

The container automatically uses a customer-managed key for encryption.

Question 11

You are analyzing sign-in logs in Microsoft Sentinel. The query returns users with ResultType 50074. What does this result type indicate?

Accepted Answer

The user did not pass strong authentication.. Option B is correct because ResultType 50074 indicates that strong authentication was required but the user did not pass it (e.g., MFA challenge failure or not performed). Option A is wrong because 50074 is not generic failure. Option C is wrong because 50074 is specific to strong authentication. Option D is wrong because it's not about conditional access policy, but authentication strength.

Answer

The user was blocked by a conditional access policy.

Answer

The user successfully signed in with MFA.

Answer

The user failed to sign in due to incorrect password.

Question 12

You run the PowerShell command to retrieve the vulnerability assessment baseline for rule VA2108 on an Azure SQL Database. The command returns a baseline with multiple rows. What is the purpose of this baseline?

Accepted Answer

It defines the expected scan result for rule VA2108, so future scans do not flag the same findings.. Option D is correct because vulnerability assessment baselines define acceptable scan results for specific rules, so that future scans do not report the same findings as vulnerabilities. Option A is wrong because baselines do not fix vulnerabilities. Option B is wrong because the baseline is for a specific database, not all databases. Option C is wrong because baselines are not about performance.

Answer

It configures the database to ignore performance issues related to rule VA2108.

Answer

It sets the baseline for all databases on the server for rule VA2108.

Answer

It automatically remediates the vulnerability identified by rule VA2108.

Question 13

Your organization is designing a solution to protect sensitive data in Microsoft 365. You need to implement Microsoft Purview Data Loss Prevention (DLP) policies. Which TWO actions can a DLP policy take when a match occurs? (Choose TWO.)

Accepted Answer

Block the sharing of sensitive information.. Options A and D are correct. DLP policies can block sharing and show a policy tip to users. Option B is wrong because auto-labeling is a separate feature (auto-labeling policies). Option C is wrong because DLP policies do not quarantine items. Option E is wrong because encryption is applied via sensitivity labels, not DLP directly.

Answer

Encrypt the file with Azure Information Protection.

Answer

Quarantine the file for administrator review.

Answer

Automatically apply a sensitivity label.

Question 14

Your company is using Microsoft Defender for Cloud to protect Azure resources. You need to implement just-in-time (JIT) VM access. Which THREE components are required? (Choose THREE.)

Accepted Answer

Microsoft Defender for Cloud enabled at the subscription level.. Options A, B, and E are required. JIT requires a VM with a network security group (NSG), enabling JIT in Defender for Cloud, and assigning permissions to request access. Option C is wrong because an Azure Bastion host is optional. Option D is wrong because a Log Analytics workspace is not required.

Answer

Log Analytics workspace for storing access logs.

Answer

Azure Bastion host for secure RDP/SSH access.

Question 15

Your organization is using Microsoft Sentinel for security operations. Which THREE data sources can be connected to Microsoft Sentinel out of the box? (Choose THREE.)

Accepted Answer

Azure Active Directory (now Microsoft Entra ID). Options A, C, and D are valid out-of-the-box connectors. Option B is wrong because Azure DevOps is not a default data connector. Option E is wrong because Power BI is not a data source connector.

Answer

Azure DevOps

Answer

Power BI