SC-100 Design security solutions for applications and data Practice Test 5 — 15 Questions

Question 1

An organization is using Microsoft Defender for Cloud to secure their Azure workloads. They have several Azure SQL databases that store sensitive financial data. The security team wants to receive alerts when a user attempts to access the database from a suspicious IP address or at an unusual time. Which Defender for Cloud plan provides this capability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Defender for SQL. Defender for Cloud includes Defender for SQL, which provides anomalous activity detection for Azure SQL databases, including alerts for suspicious IP addresses or unusual access times. Option A is correct because Defender for SQL specifically covers these capabilities. Option B is wrong because Defender for Databases is a broader plan that includes multiple database types, but the specific feature for SQL is under Defender for SQL. Option C is wrong because 'Defender for Cloud SQL' is not a valid plan name; the correct plan is Defender for SQL. Option D is wrong because Microsoft Sentinel is a SIEM solution, not a built-in database protection service within Defender for Cloud.

Answer

Defender for Databases

Answer

Defender for Cloud SQL

Answer

Microsoft Sentinel

Question 2

A company is developing a web API that will be consumed by partner applications. They need to secure the API using OAuth 2.0 and issue access tokens that expire after 1 hour. Which Microsoft Entra ID feature should they use?

Accepted Answer

App registration. Microsoft Entra ID (formerly Azure AD) provides OAuth 2.0 token issuance through app registrations. Option B is correct. Option A (Managed Identity) is wrong because it is used for Azure resources to authenticate without credentials, not for issuing tokens to partner apps. Option C (Conditional Access) is wrong because it enforces access policies, not token issuance. Option D (Azure AD B2C) is wrong because it is designed for customer identity and access management, not for partner application scenarios.

Answer

Managed Identity

Answer

Conditional Access

Answer

Azure AD B2C

Question 3

A security architect is designing a data protection strategy for a Microsoft 365 tenant. The company must prevent users from sharing sensitive documents with external users via SharePoint Online. They want to apply a policy that automatically detects sensitive content and blocks external sharing. Which Microsoft Purview solution should they use?

Accepted Answer

Data Loss Prevention (DLP) policy. Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive data and block external sharing. Option C is correct. Option A is wrong because sensitivity labels require manual application or automatic classification, but blocking external sharing is typically done by DLP. Option B is wrong because retention policies are for data retention, not blocking sharing. Option D is wrong because Microsoft Purview Information Protection is the umbrella, but the specific policy is DLP.

Answer

Sensitivity labels

Answer

Retention policies

Answer

Microsoft Purview Information Protection

Question 4

A company uses Microsoft Defender for Cloud to protect their hybrid environment. They have on-premises servers that are monitored by Microsoft Defender for Servers. The security team notices that some servers are missing critical security updates. They want to automatically remediate missing updates on these servers. Which feature should they enable?

Accepted Answer

Azure Update Manager. Microsoft Defender for Cloud integrates with Azure Update Manager (formerly known as Update Management in Azure Automation) to assess and automatically remediate missing updates. The correct answer is C. Option A (Adaptive Application Controls) controls which applications can run; it does not handle updates. Option B (Azure Automation Update Management) is the legacy solution, but Microsoft now recommends using Azure Update Manager, so it is not the best current answer. Option D (Just-in-Time VM access) controls network access to VMs, not update remediation.

Answer

Adaptive Application Controls

Answer

Azure Automation Update Management

Answer

Just-in-Time (JIT) VM access

Question 5

A company uses Microsoft Intune to manage corporate devices. They want to ensure that only compliant devices can access corporate email in Outlook Mobile. Which type of policy should they configure?

Accepted Answer

Conditional Access policy. Conditional Access in Microsoft Entra ID can require device compliance before granting access. Option C is correct because Conditional Access policies evaluate compliance status and enforce access control. Option A is wrong because app protection policies manage app-level data protection, not device compliance. Option B is wrong because device configuration policies set device settings, not access controls. Option D is wrong because compliance policies define compliance requirements, but they do not enforce access; enforcement is done via Conditional Access.

Answer

App protection policy

Answer

Device configuration policy

Answer

Compliance policy

Question 6

A company uses Microsoft Defender XDR (formerly Microsoft 365 Defender) to protect their Microsoft 365 environment. They want to ensure that sensitive data is not leaked through Microsoft Teams messages. Which TWO capabilities should they use? (Choose TWO.)

Accepted Answer

Data Loss Prevention (DLP) policies. DLP policies in Microsoft Purview can scan Teams messages for sensitive data, and Communication Compliance policies can help detect policy violations. Option A and Option D are correct. Option B (Information Barriers) is wrong because it prevents communication between groups, not data leakage. Option C (Sensitivity labels) is wrong because they are for classification, not real-time scanning of messages. Option E (Retention policies) is wrong because they are for data retention, not prevention.

Answer

Information Barriers

Answer

Sensitivity labels

Answer

Retention policies

Question 7

Refer to the exhibit. A security administrator is reviewing a Conditional Access policy JSON. They want to ensure that users with medium risk level are prompted for multi-factor authentication (MFA), while high-risk users are blocked. The policy is not working as expected. Which issue is present in the policy?

Accepted Answer

The policy requires both user and sign-in risk to be high to block, but a user with high user risk and low sign-in risk would not be blocked. The policy uses 'and' logic for user risk and sign-in risk within the same rule, meaning both must be high to trigger the block action. Consequently, a user with high user risk but low sign-in risk would not be blocked, which is incorrect. The intended behavior is to block high-risk users regardless of sign-in risk. To achieve this, separate policies should be created for medium and high risk levels, or the condition structure should be adjusted to evaluate each risk level independently. Option B correctly identifies this issue. Option A is incorrect because the policy mode is 'default', not 'report-only'. Option C is incorrect because the JSON syntax is valid. Option D is incorrect because the conditions are combined with 'and', not 'or', but the problem is not the logical operator; it's that the conjunction of both risk types being high is too restrictive.

Answer

The policy mode should be 'report-only'

Answer

The JSON syntax is invalid

Answer

The conditions are combined with 'Or' instead of 'And'

Question 8

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel to find high-risk sign-ins. The query returns no results, but they know there were high-risk sign-ins. What is the most likely reason?

Accepted Answer

The value 'high' should be 'High' (capitalized). The query correctly uses the field name 'RiskLevelDuringSignIn', but KQL string comparisons are case-sensitive. The value 'high' should be 'High' to match the stored data. Therefore, option A is correct. Option B is incorrect because '==' is the correct equality operator in KQL. Option C is incorrect because 'RiskLevelDuringSignIn' is the correct field name. Option D is incorrect because the time range is not the issue; 'ago(1d)' is valid.

Answer

The query uses double equals instead of single equals

Answer

The field name is incorrect; it should be 'RiskLevel'

Answer

The time range should be 'ago(7d)'

Question 9

Refer to the exhibit. A security architect is reviewing an ARM template that deploys an Azure Storage container. They want to ensure the container is not publicly accessible. What is the security implication of this template?

Accepted Answer

The template does not configure network rules, so the container may be accessible from the internet, but only to authenticated users. The template sets 'publicAccess' to 'None', which prevents anonymous public access. However, it does not configure network rules such as a firewall or service endpoints. By default, Azure Storage accounts allow access from any network for authenticated requests (using Azure AD or storage account keys). Therefore, while anonymous access is blocked, authenticated users from the internet can still access the container. Option D correctly identifies this security implication. Option A is incorrect because public access is explicitly set to None. Option B is incorrect because the template does not enable versioning. Option C is incorrect because encryption at rest is not configured in this template.

Answer

The container allows public access

Answer

The template creates a container with versioning enabled

Answer

The template enables encryption at rest

Question 10

Your company is migrating a legacy on-premises web application to Azure App Service. The application uses Windows Integrated Authentication and connects to a SQL Server database. You need to design a security solution that minimizes changes to the application code while ensuring secure authentication and data protection. What should you use to authenticate users?

Accepted Answer

Microsoft Entra Application Proxy. Microsoft Entra Application Proxy allows legacy on-premises apps using Windows Integrated Authentication to be published securely with Entra ID pre-authentication without requiring code changes. Option B is wrong because Microsoft Entra Domain Services provides domain join but does not directly address WIA for cloud-hosted apps without additional configuration. Option C is wrong because App Service Authentication (EasyAuth) can interfere with WIA or require code modifications. Option D is wrong because a Site-to-Site VPN secures network connectivity but does not handle user authentication.

Answer

Microsoft Entra Domain Services

Answer

App Service Authentication (EasyAuth) with Entra ID

Answer

Site-to-Site VPN with on-premises Active Directory

Question 11

Your organization uses Microsoft Sentinel to detect threats. You need to ensure that sensitive data stored in Azure SQL Database is protected from unauthorized access by Sentinel playbooks. What should you implement?

Accepted Answer

Use a managed identity assigned to the playbook to authenticate to Azure SQL. Using a managed identity assigned to the playbook allows it to authenticate to Azure SQL without storing credentials, providing secure, identity-based access control. Option A is wrong: dynamic data masking only hides sensitive data from query results but does not prevent unauthorized access or data exfiltration. Option B is wrong: customer-managed keys for Transparent Data Encryption protect data at rest, not access control. Option C is wrong: Azure SQL firewall rules are network-level and do not address authentication; playbooks may not have a static IP, and firewall rules alone do not prevent unauthorized access from allowed IPs.

Answer

Enable dynamic data masking on the SQL database

Answer

Use customer-managed keys (CMK) for SQL Transparent Data Encryption

Answer

Configure Azure SQL firewall rules to allow only Sentinel IP addresses

Question 12

Your organization is designing a data protection strategy for Microsoft 365 using Microsoft Purview. You need to protect sensitive data from being shared externally via email. Which TWO capabilities should you include?

Accepted Answer

Sensitivity labels with encryption for emails and attachments. Options A and C are correct. Sensitivity labels with encryption prevent unauthorized external sharing by encrypting emails and attachments. Data Loss Prevention (DLP) policies can detect and block emails containing sensitive information from being sent externally. Option B is incorrect because retention labels manage data lifecycle, not sharing. Option D is incorrect because Microsoft Purview Message Encryption protects messages at rest and in transit but does not prevent sharing; it is a complementary technology. Option E is incorrect because Privileged Access Management controls administrative access, not end-user data sharing.

Answer

Retention labels and policies

Answer

Microsoft Purview Message Encryption

Answer

Privileged Access Management (PAM)

Question 13

A company deploys a multi-tier application on Azure Kubernetes Service (AKS). The application uses Azure Key Vault to store secrets. You need to ensure that pod-level access to secrets is restricted to only the pods that require them. What should you implement?

Accepted Answer

Use the AKS Secret Store CSI Driver with pod-managed identities. Using the AKS Secret Store CSI Driver with pod-managed identities allows secrets from Azure Key Vault to be mounted into specific pods, ensuring that only authorized pods can access the secrets. Option A is incorrect because providing a managed identity for each pod to directly access Key Vault would require managing individual identities and does not integrate with the pod's lifecycle as seamlessly as the CSI driver. Option B is incorrect because configuring Azure RBAC on Key Vault to restrict access to the AKS cluster would give all pods in the cluster potential access, which is too coarse and does not enforce pod-level restrictions. Option C is incorrect because Azure Policy for AKS can enforce compliance rules (e.g., requiring certain labels) but does not directly manage or restrict access to secrets from Key Vault.

Answer

Use a managed identity for each pod to access Key Vault directly

Answer

Configure Azure RBAC on the Key Vault to restrict access to the AKS cluster

Answer

Apply Azure Policy to deny access to Key Vault from unauthorized namespaces

Question 14

Your company develops an API that will be consumed by external partners. You need to secure the API using Azure API Management (APIM). Which authentication mechanism should you recommend for partner applications?

Accepted Answer

OAuth 2.0 with Microsoft Entra ID. OAuth 2.0 with Microsoft Entra ID is the standard for delegated access and is suitable for partner applications. Option A is wrong because client certificates are typically used for server-to-server authentication and not ideal for partner apps. Option B is wrong because subscription keys are for identification, not authentication. Option D is wrong because IP whitelisting is network-level and not secure for authentication.

Answer

Client certificates

Answer

Subscription keys

Answer

IP address whitelisting

Question 15

Your organization is designing a solution to protect sensitive data in Microsoft SharePoint Online. You need to ensure that documents containing credit card numbers are automatically encrypted when shared with external users. What should you configure?

Accepted Answer

An auto-labeling policy for sensitivity labels with encryption. Auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels that enforce encryption based on sensitive data patterns like credit card numbers. Option A is wrong because DLP policies can block or warn but not automatically encrypt. Option B is wrong because IRM for SharePoint requires manual application or DLP integration for automatic protection. Option D is wrong because retention policies manage data lifecycle, not encryption.

Answer

A Data Loss Prevention (DLP) policy that blocks sharing

Answer

Information Rights Management (IRM) for SharePoint

Answer

A retention policy with a hold