SC-100 Design security solutions for applications and data Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing an ARM template for an Azure Function App. The function app uses a user-assigned managed identity and references a Key Vault secret for the storage connection string. The deployment fails because the function app cannot access the Key Vault secret. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user-assigned managed identity does not have a Key Vault access policy to get secrets. The correct option is D: the user-assigned managed identity lacks a Key Vault access policy granting the 'get' permission on secrets. For a Function App to resolve a Key Vault reference, its managed identity must be authorized in Key Vault's access policy (or RBAC role) to read secrets; without that grant, the reference fails even if the URI and syntax are valid. Option A is unlikely because Key Vault URIs resolve via Azure's public DNS by default and a custom DNS server would not typically be the cause. Option B would produce a specific 'secret not found' error rather than a general access failure. Option C is incorrect because the '@Microsoft.KeyVault(SecretUri=...)' syntax is the valid Key Vault reference format, so it is not the cause.

Answer

The function app is configured with a custom DNS server that cannot resolve the Key Vault URI

Answer

The secret name in the URI does not match the actual secret name in Key Vault

Answer

The Key Vault reference syntax is incorrect; it should use '@Microsoft.KeyVault(SecretUri=...)'

Question 2

Your organization uses Microsoft Entra ID for identity and access management. You need to design a solution that allows external partners to access a specific SharePoint Online site without creating guest accounts. What should you use?

Accepted Answer

Anonymous sharing links. Anonymous sharing links do not require authentication and do not create guest accounts in Microsoft Entra ID. This meets the requirement of allowing external partners to access the SharePoint site without creating guest accounts. Option B (B2B collaboration) explicitly creates guest accounts. Option C (authenticated external users) also creates guest accounts because any authenticated external sharing in SharePoint creates a guest user object in Entra ID. Option D (Azure AD B2C) is designed for customer-facing applications and is not suitable for SharePoint access, and it creates user accounts in the B2C directory, not guest accounts in the tenant.

Answer

Microsoft Entra ID business-to-business (B2B) collaboration

Answer

SharePoint Online external sharing with authenticated external users

Answer

Azure Active Directory B2C (now part of Entra ID)

Question 3

You are designing a solution for an Azure SQL Database that stores sensitive financial data. The compliance team requires that all queries are audited and that access to sensitive columns is restricted for certain users. What should you implement?

Accepted Answer

Use Always Encrypted for sensitive columns and enable Azure SQL Auditing.. Using Always Encrypted protects sensitive columns at rest and in transit, and auditing via Azure SQL Auditing meets compliance. Option A is wrong because TDE encrypts the entire database, not columns. Option B is wrong because Dynamic Data Masking masks data but does not restrict access. Option C is wrong because Row-Level Security restricts rows, not columns.

Answer

Enable Transparent Data Encryption (TDE) and SQL Server Audit.

Answer

Use Dynamic Data Masking and SQL Server Audit.

Answer

Implement Row-Level Security (RLS) and enable audit.

Question 4

You are designing an API management solution using Azure API Management. Which TWO should you implement to protect the API from unauthorized access? (Choose TWO.)

Accepted Answer

Implement OAuth 2.0 authorization with Microsoft Entra ID.. Option A is correct because implementing OAuth 2.0 authorization with Microsoft Entra ID lets API Management validate JWT access tokens issued by a trusted identity provider, ensuring only clients that successfully authenticate and receive a scoped token can call the API. Option E is correct because requiring subscription keys for all API calls makes API Management check a valid key (passed via the Ocp-Apim-Subscription-Key header or query string) tied to a product/subscription, blocking anonymous or unauthorized callers. Option B is not among the marked answers: client certificates provide mutual TLS authentication but are not one of the two selected controls here. Option C is incorrect because CORS is a browser security mechanism controlling cross-origin requests, not an access-control or authentication feature. Option D is incorrect because IP address restriction alone is a weak, easily spoofed or bypassed network control and does not authenticate the caller.

Answer

Use client certificates for authentication.

Answer

Enable Cross-Origin Resource Sharing (CORS).

Answer

Restrict access by IP address only.

Question 5

Refer to the exhibit. You are deploying an Azure Storage container for storing compliance records. The ARM template snippet above configures the container. Which statement accurately describes the configuration?

Accepted Answer

Blobs cannot be modified or deleted for 365 days after creation.. Option D is correct because the ARM template configures an immutability policy with a retention interval of 365 days, which enforces a time-based retention that prevents blobs from being modified or deleted until the retention period expires. This matches the compliance-records scenario, where WORM (write once, read many) protection is required. Option A is wrong because protected append writes apply to append blobs and require a specific allowProtectedAppendWrites setting, which is not what the snippet defines. Option B is wrong because blob versioning is a separate service feature and is not disabled by an immutability policy. Option C is wrong because anonymous read access depends on the container's public access level, not on an immutability retention policy.

Answer

The container allows protected append writes.

Answer

Blob versioning is disabled for the container.

Answer

The container allows anonymous read access.

Question 6

Your company is developing a web application that stores sensitive customer data in Azure SQL Database. The data must be encrypted at rest and in transit. Additionally, you need to ensure that only the application can access the database, not individual administrators. Which two technologies should you implement? (Choose two.)

Accepted Answer

Azure Key Vault. Azure Key Vault securely stores encryption keys used by Always Encrypted, enabling client-side key management that prevents administrators from accessing plaintext keys. Option D is correct: Always Encrypted encrypts sensitive data both at rest and in transit, and because encryption keys are stored client-side, administrators cannot view plaintext data, fulfilling the requirement that only the application can access the database. Option B is wrong: Azure Information Protection is for data classification and labeling, not database encryption. Option C is wrong: Dynamic Data Masking only obfuscates data in query results, does not provide encryption or access control. Option E is wrong: Transparent Data Encryption (TDE) encrypts data at rest but not in transit, and it does not prevent administrators from accessing plaintext data because SQL Server manages the keys.

Answer

Azure Information Protection

Answer

Dynamic Data Masking

Answer

Transparent Data Encryption (TDE)

Question 7

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft 365. You need to ensure that when a user attempts to share a document containing credit card numbers externally, the action is blocked and the user is shown a policy tip. Which DLP rule configuration should you use?

Accepted Answer

Block the action with a policy tip and allow override. Configuring the DLP rule to block the action with a policy tip and allow override satisfies both requirements: the external sharing attempt is blocked, and the user sees a policy tip explaining the policy violation while being given the option to override with justification. In Microsoft Purview DLP, the policy tip is delivered through the rule's user notification settings, and the 'allow override' setting ensures the tip includes the override option. Option B blocks the action but only sends an incident report to administrators, so the user would not see a policy tip. Option C only audits the action, meaning the sharing would not be blocked at all. Option D blocks the action without allowing override, which would prevent the user from overriding but does not match the requirement to show a policy tip with override capability.

Answer

Block the action and send an incident report in email

Answer

Audit the action only

Answer

Block the action without allowing override

Question 8

Your company runs a critical application on Azure VMs. You need to ensure that only authorized applications can run on the VMs to prevent malware. Which Azure security feature should you enable?

Accepted Answer

Windows Defender Application Control (WDAC). Windows Defender Application Control (WDAC) is the correct choice because it enforces an allowlist of trusted applications at the kernel level, ensuring only authorized code can execute on the VMs and blocking malware or unauthorized binaries. WDAC policies can be deployed to Azure VMs via Group Policy, Intune, or PowerShell, and they provide strong application control that persists regardless of user actions. Azure Security Center adaptive application controls (A) is a related but distinct feature that uses machine learning to recommend allowlists and is managed through Security Center rather than being the underlying enforcement mechanism. Just-In-Time VM access (B) only restricts inbound network access to management ports on a schedule and does not control which applications run. Azure Antimalware (C) is a signature-based antimalware agent that detects known threats but does not enforce an application allowlist.

Answer

Azure Security Center adaptive application controls

Answer

Just-In-Time VM access

Answer

Azure Antimalware

Question 9

Your company is developing a mobile application that uses Microsoft Authenticator to sign in users. The app needs to call a web API that is protected by Microsoft Entra ID. You need to ensure that the app uses the OAuth 2.0 authorization code flow with PKCE. Which Microsoft authentication library should you recommend?

Accepted Answer

Microsoft Authentication Library (MSAL). (Microsoft Graph API) is incorrect because it is not an authentication library; it is a REST API for accessing Microsoft 365 data. Option C (Active Directory Authentication Library - ADAL) is incorrect because it is deprecated and does not support PKCE. Option D (Microsoft Entra ID Graph API) is incorrect because it is deprecated and not an authentication library. Option B (Microsoft Authentication Library - MSAL) is correct because it is the recommended library for implementing the OAuth 2.0 authorization code flow with PKCE in mobile applications.

Answer

Microsoft Graph API

Answer

Active Directory Authentication Library (ADAL)

Answer

Azure AD Graph API

Question 10

A financial services company is deploying a new application on Azure Kubernetes Service (AKS). The application must meet PCI DSS compliance requirements, which mandate encryption of data at rest and in transit, as well as network segmentation. The application will use Azure SQL Database. What is the MOST secure approach to meet these requirements?

Accepted Answer

Use Azure Policy to enforce encryption and network policies in AKS, and enable TDE and Always Encrypted for Azure SQL Database.. Using Azure Policy to enforce encryption and network policies in AKS ensures compliance at scale, while enabling TDE and Always Encrypted on Azure SQL Database provides encryption at rest and in transit, with Always Encrypted offering additional protection for sensitive data. This combination directly addresses PCI DSS requirements for encryption and segmentation.

Answer

Deploy the application in an Azure App Service Environment (ASE) with a private endpoint and enable SQL Server encryption.

Answer

Use Azure Service Endpoints for the AKS cluster and enable Transparent Data Encryption (TDE) on Azure SQL Database.

Answer

Deploy Azure Firewall in front of the AKS cluster and enable SSL/TLS termination at the firewall for all incoming traffic.

Question 11

Your organization is developing a new application that will use Azure Cosmos DB. The security team requires that all data be encrypted at rest and in transit, and that access to the database is limited to specific Azure services and IP addresses. The application will run on Azure VMs. Which three actions should you take? (Choose three.)

Accepted Answer

Configure Cosmos DB to require TLS for all client connections.. Option A is correct because Cosmos DB supports enforcing TLS (HTTPS) for all client connections, which satisfies the requirement that data be encrypted in transit between the Azure VMs and the database. Option C is correct because a private endpoint places the Cosmos DB account on a private IP within a VNet, letting you restrict access to only that endpoint and block public exposure, which meets the requirement to limit access to specific Azure services and IP addresses. Option D is correct because enabling encryption at rest with customer-managed keys (stored in Azure Key Vault) ensures data at rest is encrypted under keys the organization controls, satisfying the encryption-at-rest requirement. Option B is not correct because migrating to Azure SQL Database is a different service and does not address the stated Cosmos DB scenario. Option E is not correct because allowing access from all Azure services opens the firewall broadly rather than limiting access to specific services and IP addresses.

Answer

Use Azure SQL Database instead of Cosmos DB for better security features.

Answer

Configure the Cosmos DB firewall to allow access from all Azure services.

Question 12

You are designing a solution for a multi-national corporation that uses Microsoft Purview to govern data across Azure SQL Database, Azure Data Lake Storage, and Microsoft 365. The data classification labels must be automatically applied based on sensitive data types such as credit card numbers and passport numbers. Which Microsoft Purview capability should you use?

Accepted Answer

Microsoft Purview Data Map with automatic classification. The correct option is D, Microsoft Purview Data Map with automatic classification, because the Data Map scans and registers sources such as Azure SQL Database, Azure Data Lake Storage, and Microsoft 365, and its built-in and custom classification rules automatically detect sensitive data types like credit card numbers and passport numbers. Automatic classification in the Data Map is precisely the capability that applies sensitivity labels based on those detected types across the governed estate. Option A, DLP policies, is about preventing sharing or transfer of sensitive data rather than discovering and labeling it. Option B, Audit, only records and retains activity events for investigation and compliance. Option C, Information Protection, provides the sensitivity labels and protection policies but relies on the Data Map's classification to apply them automatically at scale.

Answer

Microsoft Purview Data Loss Prevention (DLP) policies

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Information Protection

Question 13

A company is building a new SaaS application that will be used by external customers. The application uses Azure API Management (APIM) to expose APIs. The security requirements include: (1) Only authenticated and authorized customers can call the APIs, (2) The API keys must be rotated automatically every 90 days, (3) The APIs must be protected against common web vulnerabilities. What should you implement?

Accepted Answer

Use OAuth 2.0 with Azure AD (Entra ID) for authentication, configure API key rotation in APIM policies, and enable Azure Web Application Firewall (WAF) in front of APIM.. It addresses all three requirements: OAuth 2.0 with Microsoft Entra ID (Entra ID) provides authenticated and authorized access for external customers, APIM policies can enforce API key rotation (e.g., via named values and policy expressions tied to Key Vault), and Azure WAF in front of APIM protects against common web vulnerabilities such as SQL injection and XSS. Option A is insufficient because IP whitelisting does not authenticate customers and manual key rotation does not meet the automatic 90-day requirement. Option B does not provide the required OAuth-based customer authorization and APIM cannot automatically rotate client certificates. Option D lacks a WAF or equivalent protection against common web vulnerabilities, so it does not satisfy the third requirement.

Answer

Use IP whitelisting in APIM to restrict access to known customer IPs and enable API key rotation manually every 90 days.

Answer

Require client certificates for authentication and configure APIM to automatically rotate the certificates.

Answer

Implement OAuth 2.0 with JWT tokens and use rate limiting to mitigate attacks.

Question 14

You are designing a secure data sharing solution for a research organization that needs to share large datasets with external universities. The data must be encrypted at rest and in transit, and access must be time-limited. The solution should minimize administrative overhead. What should you use?

Accepted Answer

Azure Storage with shared access signatures (SAS) and Azure Key Vault. Azure Storage shared access signatures (SAS) provide time-limited, scoped access tokens that can be revoked, while Azure Key Vault centrally manages the encryption keys used for encryption at rest, and HTTPS/TLS secures data in transit—together meeting the encryption, time-limited access, and low administrative overhead requirements. SAS tokens can be configured with start/expiry times and specific permissions, and Key Vault removes the burden of manually managing keys. Option A (Blob Storage with SFTP) supports secure transfer but does not natively provide time-limited access or key management. Option B (Azure Data Share) is designed for snapshot-based sharing but does not inherently enforce time-limited access or customer-managed encryption keys. Option D (Azure File Sync) is for hybrid file synchronization with on-premises servers and does not fit external, time-limited dataset sharing.

Answer

Azure Blob Storage with SFTP protocol enabled

Answer

Azure Data Share with snapshot-based sharing

Answer

Azure File Sync with on-premises file servers

Question 15

A company is using Microsoft Defender for Cloud to secure their Azure environment. They have enabled the 'Defender for Cloud's integrated workload protection' plan for Azure SQL Database. Which TWO of the following security features are included in this plan?

Accepted Answer

Vulnerability assessment. Option C (Vulnerability assessment) is correct because Microsoft Defender for Azure SQL Database includes a built-in vulnerability assessment feature that scans databases for security misconfigurations and recommends remediation steps. Option E (Advanced Threat Protection (ATP)) is correct because the Defender for Azure SQL plan provides advanced threat detection that identifies anomalous database activities, potential SQL injection attacks, and suspicious access patterns. Option A (Microsoft Purview Information Protection) is incorrect because it is a separate data classification and labeling service, not part of the Defender for SQL workload protection plan. Option B (Azure Policy) is incorrect because it is a governance service used to enforce organizational standards, not a feature bundled with Defender for SQL. Option D (Transparent Data Encryption (TDE)) is incorrect because TDE is a native Azure SQL Database encryption feature available independently of Defender for Cloud's workload protection plan.

Answer

Microsoft Purview Information Protection

Answer

Azure Policy

Answer

Transparent Data Encryption (TDE)