SC-100 Design security solutions for applications and data Practice Test 4 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel to detect threats. You need to design a solution that automatically remediates a detected threat on an Azure VM by isolating the VM from the network. What should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Microsoft Sentinel automation rule that triggers a playbook to run an Azure Automation runbook to modify the NSG.. Microsoft Sentinel can trigger a playbook (automation rule) that runs an Azure Automation runbook to modify the NSG and isolate the VM. Option B is wrong because Log Analytics workspace doesn't have remediation actions. Option C is wrong because Azure Policy is for compliance, not incident response. Option D is wrong because Defender for Cloud has some automation, but Sentinel playbook is the designed method for automated response.

Answer

Configure a Log Analytics workspace query to run on a schedule and automatically block the VM.

Answer

Use Azure Policy to audit and automatically remediate non-compliant VMs.

Answer

Enable Microsoft Defender for Cloud's 'Just-in-time VM access' policy.

Question 2

Your company uses Microsoft Intune for mobile device management. You need to ensure that corporate data on iOS devices is protected by requiring a PIN and encrypting the device. What configuration should you create?

Accepted Answer

Create a compliance policy that requires a device PIN and encryption.. A compliance policy in Intune defines device requirements like PIN and encryption. Option A is wrong because a device configuration profile can enforce settings but does not inherently enforce compliance; compliance policy is the standard way to require PIN and encryption. Option B is wrong because Conditional Access policies control access based on compliance, not enforce settings directly. Option D is wrong because app protection policies target apps, not device-level settings.

Answer

Create a device configuration profile to enforce PIN and encryption.

Answer

Create a Conditional Access policy that requires compliant devices.

Answer

Create an app protection policy for Microsoft apps.

Question 3

Your organization is deploying Microsoft Defender for Cloud Apps. You need to create a policy that blocks downloads of sensitive files from sanctioned cloud apps to unmanaged devices. What type of policy should you create?

Accepted Answer

Session policy. Session policies in Defender for Cloud Apps can monitor and control user sessions in real-time, including blocking downloads based on device tags (e.g., unmanaged devices). Option B is wrong because app discovery policies are for discovering shadow IT, not controlling downloads. Option C is wrong because anomaly detection policies detect unusual behavior, not block downloads. Option D is wrong because access policies control access at the app level but do not enforce session-level actions like downloads.

Answer

App discovery policy

Answer

Anomaly detection policy

Answer

Access policy

Question 4

Your organization uses Azure API Management (APIM) to expose APIs to external partners. You need to ensure that only authorized partners can access the APIs and that the API requests are rate-limited to prevent abuse. What should you implement?

Accepted Answer

Use a validate JWT policy to authenticate partners and a rate-limit by key policy to control request rates.. APIM's validate JWT policy allows you to authenticate partners by validating their JSON Web Tokens, ensuring only authorized partners access the APIs. The rate-limit by key policy can then limit requests based on the partner's subscription key, preventing abuse. Option B is incorrect because a global rate limit applies to all requests, not per partner, and client certificate authentication alone doesn't provide fine-grained authorization. Option C is incorrect because subscription keys are easily shared and not secure for partner authentication, and IP whitelisting is impractical for external partners with dynamic IPs. Option D is incorrect because storing API keys in Key Vault doesn't control access or rate limiting; APIM can validate OAuth tokens via policies, but the combination mentioned isn't effective for this scenario.

Answer

Configure client certificate authentication and set a global rate limit in the APIM service.

Answer

Require a subscription key for each partner and configure IP whitelisting.

Answer

Use OAuth 2.0 tokens and store partner API keys in Azure Key Vault.

Question 5

Your organization uses Microsoft Purview to govern data assets across Azure and on-premises. You need to automatically classify sensitive data such as credit card numbers in Azure SQL Database. What should you use?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map can scan Azure SQL Database and apply automatic classification using built-in classifiers for sensitive data like credit card numbers. Option B is incorrect because Microsoft Defender for Cloud focuses on security posture and threat protection, not data classification. Option C is incorrect because Microsoft Entra ID is an identity and access management service. Option D is incorrect because Microsoft Sentinel is a SIEM solution for security analytics and threat intelligence.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Entra ID

Answer

Microsoft Sentinel

Question 6

You are reviewing the ARM template snippet for an Azure Storage container. What does the 'denyEncryptionScopeOverride' property set to 'true' ensure?

Accepted Answer

Users cannot override the default encryption scope for blobs in this container.. The 'denyEncryptionScopeOverride' property set to 'true' ensures that users cannot override the default encryption scope for blobs in this container. When set to true, any blob upload that specifies a different encryption scope is denied. This enforces the use of the default encryption scope for all blobs. Option A is incorrect because double encryption is controlled by a different setting. Option B is incorrect because encryption at rest is always enabled for Azure Storage; this setting does not control encryption at rest itself. Option C is incorrect because it does not require a customer-managed key; it only prevents overriding the scope, which could be either Microsoft-managed or customer-managed.

Answer

Double encryption is enabled for the container.

Answer

Encryption at rest is required for all blobs in the container.

Answer

The container automatically uses a customer-managed key for encryption.

Question 7

You are analyzing sign-in logs in Microsoft Sentinel. The query returns users with ResultType 50074. What does this result type indicate?

Accepted Answer

The user did not pass strong authentication.. ResultType 50074 indicates that strong authentication was required but the user did not pass it (e.g., MFA challenge failure or not performed). Option A is wrong because 50074 is not generic failure. Option C is wrong because 50074 is specific to strong authentication. Option D is wrong because it's not about conditional access policy, but authentication strength.

Answer

The user was blocked by a conditional access policy.

Answer

The user successfully signed in with MFA.

Answer

The user failed to sign in due to incorrect password.

Question 8

You run the PowerShell command to retrieve the vulnerability assessment baseline for rule VA2108 on an Azure SQL Database. The command returns a baseline with multiple rows. What is the purpose of this baseline?

Accepted Answer

It defines the expected scan result for rule VA2108, so future scans do not flag the same findings.. Vulnerability assessment baselines define acceptable scan results for specific rules, so that future scans do not report the same findings as vulnerabilities. Option A is wrong because baselines do not fix vulnerabilities. Option B is wrong because the baseline is for a specific database, not all databases. Option C is wrong because baselines are not about performance.

Answer

It configures the database to ignore performance issues related to rule VA2108.

Answer

It sets the baseline for all databases on the server for rule VA2108.

Answer

It automatically remediates the vulnerability identified by rule VA2108.

Question 9

Your organization is designing a solution to protect sensitive data in Microsoft 365. You need to implement Microsoft Purview Data Loss Prevention (DLP) policies. Which TWO actions can a DLP policy take when a match occurs? (Choose TWO.)

Accepted Answer

Block the sharing of sensitive information.. Microsoft Purview DLP policies can block sharing of sensitive information (option D) and show a policy tip to users (option E). Option A is incorrect because encryption is applied via sensitivity labels, not directly by DLP. Option B is incorrect because DLP policies do not quarantine items; that is typically done by retention policies or eDiscovery. Option C is incorrect because auto-labeling is handled by separate auto-labeling policies, not DLP.

Answer

Encrypt the file with Azure Information Protection.

Answer

Quarantine the file for administrator review.

Answer

Automatically apply a sensitivity label.

Question 10

Your company is using Microsoft Defender for Cloud to protect Azure resources. You need to implement just-in-time (JIT) VM access. Which THREE components are required? (Choose THREE.)

Accepted Answer

Microsoft Defender for Cloud enabled at the subscription level.. Options A, B, and E are required. JIT requires a VM with a network security group (NSG), enabling JIT in Defender for Cloud, and assigning permissions to request access. Option C is wrong because a Log Analytics workspace is not required. Option D is wrong because an Azure Bastion host is optional.

Answer

Log Analytics workspace for storing access logs.

Answer

Azure Bastion host for secure RDP/SSH access.

Question 11

Your organization is using Microsoft Sentinel for security operations. Which THREE data sources can be connected to Microsoft Sentinel out of the box? (Choose THREE.)

Accepted Answer

Azure Active Directory (now Microsoft Entra ID). Options A (Azure Active Directory/Entra ID), B (AWS CloudTrail), and D (Microsoft 365 Defender) are all supported out-of-the-box data connectors in Microsoft Sentinel. Option C (Azure DevOps) is not a built-in connector; it requires a custom API or solution. Option E (Power BI) is not a data source connector for Sentinel.

Answer

Azure DevOps

Answer

Power BI

Question 12

A company uses Microsoft Defender for Cloud Apps to enforce session policies. The security team needs to block downloads of sensitive files from Microsoft 365 when accessed from unmanaged devices. Which type of policy should they configure?

Accepted Answer

Session policy. Session policies in Defender for Cloud Apps allow real-time monitoring and control of user activities based on device state. Option C is correct. Option A is wrong because file policies are post-hoc, not real-time. Option B is wrong because DLP policies in Microsoft 365 are broader and not tied to session enforcement. Option D is wrong because access policies govern access at the app level, not session-level controls.

Answer

File policy

Answer

Data Loss Prevention (DLP) policy in Microsoft 365

Answer

Access policy

Question 13

A healthcare organization is designing a zero-trust application security strategy. They use Microsoft Entra ID for identity and plan to deploy a legacy on-premises web application with no modern authentication support. The solution must ensure that only authorized users can access the app and that access is logged for auditing. Which Microsoft security service should they use to secure access?

Accepted Answer

Microsoft Entra application proxy. Microsoft Entra application proxy provides secure remote access and conditional access for on-premises legacy apps without requiring VPN or changes to the app. This is the correct solution. Option A (Azure AD B2C) is for customer-facing apps, not internal legacy apps. Option C (Microsoft Defender for Cloud Apps) is for cloud app security, not direct access control. Option D (Microsoft Intune) is for device management, not application access.

Answer

Azure AD B2C

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Intune

Question 14

A multinational corporation uses Microsoft Purview to classify and protect sensitive data. They need to ensure that any email containing a patient health record (PHI) is encrypted before delivery. Which capability should they use?

Accepted Answer

Microsoft Purview Message Encryption. Microsoft Purview Message Encryption. This capability allows sending encrypted email and can be enforced via DLP policies to automatically encrypt emails containing PHI. Option A (DLP policy) is wrong because DLP policies detect sensitive data and can trigger actions such as encrypting the email, but the encryption action relies on Microsoft Purview Message Encryption. Option B (Sensitivity label with encryption) is wrong because while sensitivity labels can apply encryption to documents and emails, automatic encryption of emails based on content requires a DLP policy with encryption action, not just a label. Option C (Azure Information Protection) is wrong because it is the underlying technology but is configured and managed through Microsoft Purview; the question asks for the capability, which is Message Encryption.

Answer

Data Loss Prevention (DLP) policy

Answer

Sensitivity label with encryption

Answer

Azure Information Protection

Question 15

A company uses Microsoft Sentinel for security operations. They want to collect logs from a custom application running on Azure Virtual Machines. The application writes logs to a local file. Which data connector should they use?

Accepted Answer

Custom Logs via Log Analytics agent. Custom Logs via Log Analytics agent. The Log Analytics agent (or Azure Monitor Agent) can ingest custom log files from Windows or Linux VMs, making it ideal for a custom application that writes logs to a local file. Option A (Application Insights) is for application performance monitoring and does not collect local file logs. Option B (Syslog) is used for Linux system logs, not custom file logs. Option C (Windows Event Forwarding) collects Windows Event Logs, not custom file logs.

Answer

Application Insights

Answer

Syslog

Answer

Windows Event Forwarding