SC-100 Design security solutions for applications and data Practice Test 5 — 15 Questions

Question 1

A company uses Microsoft Defender for Cloud Apps to enforce session policies. The security team needs to block downloads of sensitive files from Microsoft 365 when accessed from unmanaged devices. Which type of policy should they configure?

Accepted Answer

Session policy. Session policies in Defender for Cloud Apps allow real-time monitoring and control of user activities based on device state. Option A is correct. Option B is wrong because file policies are post-hoc, not real-time. Option C is wrong because access policies govern access at the app level, not session-level controls. Option D is wrong because DLP policies in Microsoft 365 are broader and not tied to session enforcement.

Answer

File policy

Answer

Data Loss Prevention (DLP) policy in Microsoft 365

Answer

Access policy

Question 2

A healthcare organization is designing a zero-trust application security strategy. They use Microsoft Entra ID for identity and plan to deploy a legacy on-premises web application with no modern authentication support. The solution must ensure that only authorized users can access the app and that access is logged for auditing. Which Microsoft security service should they use to secure access?

Accepted Answer

Microsoft Entra application proxy. Microsoft Entra application proxy provides secure remote access and conditional access for on-premises apps without requiring VPN or changes to the app. Option A is correct. Option B is wrong because Defender for Cloud Apps is for cloud apps. Option C is wrong because Azure AD B2C is for customer-facing apps. Option D is wrong because Microsoft Intune is for device management, not app access.

Answer

Azure AD B2C

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Intune

Question 3

A multinational corporation uses Microsoft Purview to classify and protect sensitive data. They need to ensure that any email containing a patient health record (PHI) is encrypted before delivery. Which capability should they use?

Accepted Answer

Microsoft Purview Message Encryption. Microsoft Purview Message Encryption allows sending encrypted email. Option B is correct. Option A is wrong because DLP policies trigger actions like blocking or encrypting, but the encryption itself is done by Message Encryption. Option C is wrong because sensitivity labels can apply encryption, but for automatic encryption of emails, DLP with encryption action is typical. Option D is wrong because Azure Information Protection is the underlying technology, but the policy is configured via Purview.

Answer

Data Loss Prevention (DLP) policy

Answer

Sensitivity label with encryption

Answer

Azure Information Protection

Question 4

A company uses Microsoft Sentinel for security operations. They want to collect logs from a custom application running on Azure Virtual Machines. The application writes logs to a local file. Which data connector should they use?

Accepted Answer

Custom Logs via Log Analytics agent. The Log Analytics agent (or Azure Monitor Agent) can collect custom log files from VMs. Option C is correct. Option A is wrong because Syslog is for Linux, but the application writes to a file, not syslog. Option B is wrong because Windows Event Log is for Windows event logs, not custom file logs. Option D is wrong because Application Insights is for application performance monitoring, not log file collection.

Answer

Application Insights

Answer

Syslog

Answer

Windows Event Forwarding

Question 5

An organization is using Microsoft Defender for Cloud to secure their Azure workloads. They have several Azure SQL databases that store sensitive financial data. The security team wants to receive alerts when a user attempts to access the database from a suspicious IP address or at an unusual time. Which Defender for Cloud plan provides this capability?

Accepted Answer

Defender for SQL. Defender for Cloud includes Defender for SQL, which provides anomalous activity detection for Azure SQL databases. Option B is correct. Option A is wrong because Defender for Databases is a broader plan that includes SQL detection, but the specific feature is anomalous activity. Option C is wrong because Defender for Cloud SQL is not a plan name. Option D is wrong because Microsoft Sentinel is for SIEM, not built-in database protection.

Answer

Defender for Databases

Answer

Defender for Cloud SQL

Answer

Microsoft Sentinel

Question 6

A company is developing a web API that will be consumed by partner applications. They need to secure the API using OAuth 2.0 and issue access tokens that expire after 1 hour. Which Microsoft Entra ID feature should they use?

Accepted Answer

App registration. Microsoft Entra ID (formerly Azure AD) provides OAuth 2.0 token issuance through app registrations. Option B is correct. Option A is wrong because Conditional Access is for access policies, not token issuance. Option C is wrong because Managed Identity is for Azure resources, not partner apps. Option D is wrong because Azure AD B2C is for customer identities.

Answer

Managed Identity

Answer

Conditional Access

Answer

Azure AD B2C

Question 7

A security architect is designing a data protection strategy for a Microsoft 365 tenant. The company must prevent users from sharing sensitive documents with external users via SharePoint Online. They want to apply a policy that automatically detects sensitive content and blocks external sharing. Which Microsoft Purview solution should they use?

Accepted Answer

Data Loss Prevention (DLP) policy. Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive data and block external sharing. Option C is correct. Option A is wrong because sensitivity labels require manual application or automatic classification, but blocking external sharing is typically done by DLP. Option B is wrong because retention policies are for data retention, not blocking sharing. Option D is wrong because Microsoft Purview Information Protection is the umbrella, but the specific policy is DLP.

Answer

Sensitivity labels

Answer

Retention policies

Answer

Microsoft Purview Information Protection

Question 8

A company uses Microsoft Defender for Cloud to protect their hybrid environment. They have on-premises servers that are monitored by Microsoft Defender for Servers. The security team notices that some servers are missing critical security updates. They want to automatically remediate missing updates on these servers. Which feature should they enable?

Accepted Answer

Azure Update Manager. Defender for Cloud can integrate with Azure Update Manager (formerly Update Management) to remediate missing updates. Option D is correct. Option A is wrong because Azure Automation Update Management is the legacy solution, but the current recommendation is Azure Update Manager. Option B is wrong because Just-in-Time access is for VM access control. Option C is wrong because Adaptive Application Controls are for allowing specific applications.

Answer

Adaptive Application Controls

Answer

Azure Automation Update Management

Answer

Just-in-Time (JIT) VM access

Question 9

A company uses Microsoft Intune to manage corporate devices. They want to ensure that only compliant devices can access corporate email in Outlook Mobile. Which type of policy should they configure?

Accepted Answer

Conditional Access policy. Conditional Access in Microsoft Entra ID can require device compliance before granting access. Option B is correct. Option A is wrong because compliance policies define what compliance means, but the enforcement is via Conditional Access. Option C is wrong because app protection policies are for app-level controls, not device compliance. Option D is wrong because device configuration policies are for settings, not access control.

Answer

App protection policy

Answer

Device configuration policy

Answer

Compliance policy

Question 10

A company is designing a data classification strategy using Microsoft Purview. They need to automatically classify and protect sensitive data stored in Azure Blob Storage. Which TWO capabilities should they use? (Choose TWO.)

Accepted Answer

Sensitivity labels. Microsoft Purview Data Map provides auto-discovery and classification of data assets, and Sensitivity labels can apply protection. Option A and Option C are correct. Option B is wrong because DLP policies are for endpoint and Microsoft 365, not for Azure Blob. Option D is wrong because Information Barriers are for restricting communication, not classification. Option E is wrong because Azure Policy is for governance, not data classification.

Answer

Data Loss Prevention (DLP) policies

Answer

Information Barriers

Answer

Azure Policy

Question 11

A financial services company uses Microsoft Sentinel for SIEM. They need to detect potential data exfiltration from their Azure SQL Database. Which THREE data sources should they connect to Sentinel to achieve this? (Choose THREE.)

Accepted Answer

Azure Network Watcher NSG flow logs. Azure SQL Database audit logs contain query details; Azure Activity Logs provide resource management events; Network security group flow logs show network traffic patterns. Option A, Option B, and Option C are correct. Option D is wrong because Azure AD sign-in logs are for user authentication, not database operations. Option E is wrong because Microsoft Defender for Cloud alerts may cover threats but not raw data exfiltration details.

Answer

Microsoft Defender for Cloud alerts

Answer

Azure AD sign-in logs

Question 12

A company uses Microsoft Defender XDR (formerly Microsoft 365 Defender) to protect their Microsoft 365 environment. They want to ensure that sensitive data is not leaked through Microsoft Teams messages. Which TWO capabilities should they use? (Choose TWO.)

Accepted Answer

Data Loss Prevention (DLP) policies. DLP policies in Microsoft Purview can scan Teams messages for sensitive data, and Communication Compliance policies can help detect policy violations. Option A and Option C are correct. Option B is wrong because sensitivity labels are for manual or automatic classification, not real-time scanning of messages. Option D is wrong because retention policies are for data retention, not prevention. Option E is wrong because Information Barriers prevent communication between groups, not data leakage.

Answer

Information Barriers

Answer

Sensitivity labels

Answer

Retention policies

Question 13

Refer to the exhibit. A security administrator is reviewing a Conditional Access policy JSON. They want to ensure that users with medium risk level are prompted for multi-factor authentication (MFA), while high-risk users are blocked. The policy is not working as expected. Which issue is present in the policy?

Accepted Answer

The policy requires both user and sign-in risk to be high to block, but a user with high user risk and low sign-in risk would not be blocked. The policy uses 'and' logic for user and sign-in risk within the same rule, meaning both must be high to block, and both must be medium to require MFA. However, the conditions are combined with implicit 'and'. For the intended effect, separate policies or different condition structure is needed. Option C is correct. Option A is wrong because the syntax is valid JSON. Option B is wrong because there is no 'Or' condition issue; it's 'and'. Option D is wrong because the policy mode is 'default'.

Answer

The policy mode should be 'report-only'

Answer

The JSON syntax is invalid

Answer

The conditions are combined with 'Or' instead of 'And'

Question 14

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel to find high-risk sign-ins. The query returns no results, but they know there were high-risk sign-ins. What is the most likely reason?

Accepted Answer

The value 'high' should be 'High' (capitalized). The query uses 'RiskLevelDuringSignIn' and 'RiskLevelAggregated' but filters on 'RiskLevelDuringSignIn'. However, in the schema, the field is named 'RiskLevelDuringSignIn' correctly. But the query uses 'where RiskLevelDuringSignIn == "high"' but the field may store values as 'High' (capitalized). Option C is correct. Option A is wrong because the field exists. Option B is wrong because the query is valid syntax. Option D is wrong because the time range is last 1 day.

Answer

The query uses double equals instead of single equals

Answer

The field name is incorrect; it should be 'RiskLevel'

Answer

The time range should be 'ago(7d)'

Question 15

Refer to the exhibit. A security architect is reviewing an ARM template that deploys an Azure Storage container. They want to ensure the container is not publicly accessible. What is the security implication of this template?

Accepted Answer

The template does not configure network rules, so the container may be accessible from the internet, but only to authenticated users. The template sets 'publicAccess' to 'None', which means no anonymous access. However, the container inherits default network rules from the storage account. If the storage account firewall is not configured, the container may still be accessible over the internet by authenticated users. Option C is correct. Option A is wrong because public access is set to None. Option B is wrong because network rules are not defined in this template. Option D is wrong because the template does not mention encryption.

Answer

The container allows public access

Answer

The template creates a container with versioning enabled

Answer

The template enables encryption at rest