SC-100 Design security solutions for applications and data Practice Test 5 — 15 Questions

Question 1

You are designing a solution to protect a web application hosted on Azure App Service. The application uses Azure SQL Database and stores sensitive customer data. You need to ensure that the data is encrypted at rest and in transit, and that the application is protected from common web attacks. Which TWO of the following should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enforce TLS for Azure SQL Database connections. Enforce TLS for Azure SQL Database connections ensures data in transit is encrypted, meeting the encryption requirement. Option D: Azure Web Application Firewall (WAF) on Azure Front Door protects against common web attacks like SQL injection and XSS. Option A is incorrect because Azure Private Link provides private connectivity but does not directly protect against web attacks or encrypt data in transit. Option C is incorrect because Network Security Groups (NSGs) filter network traffic but do not provide encryption or web application protection. Option E is incorrect because Azure DDoS Protection Standard protects against network-layer attacks, not specifically web application attacks.

Answer

Azure Private Link for App Service

Answer

Network Security Groups (NSGs) on the subnet

Answer

Azure DDoS Protection Standard

Question 2

Refer to the exhibit. What is the purpose of this KQL query?

Accepted Answer

To retrieve SQL injection alerts from the past 7 days with specific fields.. The query filters for SQL injection alerts in the last 7 days and projects relevant columns. Option A is wrong because it does not show all alerts, only SQL injection ones. Option C is wrong because it does not join with other tables. Option D is wrong because it does not aggregate or count alerts.

Answer

To count the number of SQL injection alerts by severity.

Answer

To join security alerts with other data sources to find compromised entities.

Answer

To list all security alerts generated in the last 7 days.

Question 3

Your organization uses Microsoft Entra Verified ID to issue verifiable credentials to employees. You need to design a solution that allows employees to prove their employment status to third-party apps without exposing their full identity. What should you implement?

Accepted Answer

Verifiable credentials with a custom credential type. A verifiable credential can contain only the attributes required (e.g., employment status) and is presented via a wallet. Option A is wrong because a custom role does not issue credentials. Option C is wrong because managed identities are for Azure resources, not user identity. Option D is wrong because Conditional Access controls access but does not issue proofs.

Answer

Microsoft Entra ID custom roles

Answer

Azure managed identities

Answer

Conditional Access policy with session controls

Question 4

Your organization is developing a Power BI dashboard that uses data from an Azure SQL Database. The data includes personally identifiable information (PII). You need to mask the PII from certain users while allowing full access to data owners. What should you use?

Accepted Answer

Dynamic data masking in Azure SQL Database and row-level security in Power BI. Dynamic data masking in Azure SQL Database masks sensitive PII columns at query time for non-privileged users, while data owners with the UNMASK permission continue to see full values; row-level security in Power BI can further restrict which rows each user sees in the dashboard. Together these controls satisfy the requirement to hide PII from certain users while preserving full access for data owners. Option A does not mask data—auditing and Defender for Cloud only detect, log, and alert on threats. Option B provides data discovery, cataloging, and lineage through Microsoft Purview but does not enforce masking at query time. Option D applies sensitivity labels for classification and protection but does not dynamically mask PII values in Azure SQL query results.

Answer

Azure SQL Database auditing and Microsoft Defender for Cloud

Answer

Microsoft Purview Data Map and data catalog

Answer

Microsoft Purview sensitivity labels and auto-labeling

Question 5

A company is designing a solution to protect Azure Functions that process sensitive data. They need to ensure that only authenticated and authorized callers can invoke the function, and that secrets are not hard-coded. Which THREE actions should they take?

Accepted Answer

Use managed identity to access Azure Key Vault for secrets. Option C is correct because a system-assigned or user-assigned managed identity lets the Function app authenticate to Azure Key Vault without storing credentials in code or configuration, eliminating hard-coded secrets. Option D is correct because enabling Microsoft Entra ID (Microsoft Entra ID) authentication on the function app enforces token-based authentication so only authenticated and authorized callers can invoke the function. Option E is correct because setting the authorization level to 'Function' or 'Admin' requires a valid function key or master key on every HTTP request, adding an authorization check beyond anonymous access. Option A is not appropriate because application settings are plaintext configuration values visible to anyone with portal or ARM access, so they do not satisfy the 'no hard-coded secrets' requirement. Option B is not required because client certificates are a mutual-TLS mechanism that is not the standard way to authenticate callers to Azure Functions and does not by itself provide the authorization model described.

Answer

Store connection strings in application settings

Answer

Require client certificates

Question 6

You have created a custom Azure RBAC role named 'Custom SQL DB Reader' as shown in the exhibit. You assign this role to a user. The user reports they cannot read data from an Azure SQL Database. What is the most likely cause?

Accepted Answer

The Azure SQL Database is not configured to support Azure AD authentication. The Azure SQL Database is not configured to support Microsoft Entra ID authentication. Azure RBAC roles, including custom roles with dataActions, only govern access to the data plane when the user authenticates to Azure SQL via Microsoft Entra ID (now Microsoft Entra ID); if the logical server lacks an Microsoft Entra ID administrator or the database doesn't allow Microsoft Entra ID auth, the user's RBAC assignment has no effect on reading data. Options B and D are incorrect because the scenario states the role was created for reading SQL DB data, and the failure is about authentication, not missing actions; moreover, a missing 'read' action or dataActions would be a role-definition issue, not the most likely cause given the exhibit. Option C is also wrong because assignableScopes controls where the role can be assigned, not whether the user can authenticate to the database.

Answer

The role does not include 'Microsoft.Sql/servers/databases/read' action

Answer

The assignableScopes does not include the resource group

Answer

The role does not include any dataActions

Question 7

Your organization uses Microsoft Defender for Cloud Apps to protect SaaS applications. You need to configure a policy that blocks downloads of files tagged as 'Highly Confidential' from SharePoint Online and triggers an automated investigation. Which policy type should you use?

Accepted Answer

Access policy. An access policy in Defender for Cloud Apps can enforce real-time controls like blocking downloads based on sensitivity labels. Option A is wrong because session policy controls user sessions but does not natively block downloads by label. Option B is wrong because app discovery policy discovers shadow IT, not controls access. Option D is wrong because anomaly detection policy detects unusual behavior but does not block downloads.

Answer

Session policy

Answer

App discovery policy

Answer

Anomaly detection policy

Question 8

Your organization uses Microsoft Defender for Cloud to secure multi-cloud workloads. You need to ensure that Azure, AWS, and GCP resources are assessed against a common set of security standards. Which capability should you use?

Accepted Answer

Regulatory compliance standards. Regulatory compliance standards, because in Microsoft Defender for Cloud this capability lets you assign built-in or custom security standards (such as Azure Security Benchmark, ISO 27001, PCI DSS, and CIS) and continuously assess Azure, AWS, and GCP resources against that common set of controls, with multi-cloud coverage shown in the regulatory compliance dashboard. This directly matches the requirement to evaluate resources across all three clouds against shared security standards. Option C, CSPM, is the broader Defender for Cloud posture-management foundation that surfaces recommendations and secure score, but the specific mechanism for assessing against a named common standard is the regulatory compliance standards feature. Option B, vulnerability assessment solutions, only scans machines, containers, and registries for software vulnerabilities and does not map resources to security standards. Option D, JIT VM access, only controls inbound network access to VMs on demand and has nothing to do with standards-based assessment.

Answer

Vulnerability assessment solutions

Answer

Cloud Security Posture Management (CSPM)

Answer

Just-in-time (JIT) VM access

Question 9

Your organization uses Microsoft Purview to map and classify data across Azure, on-premises, and multi-cloud sources. You need to ensure that sensitive data assets are automatically discovered and classified. Which Microsoft Purview component should you configure?

Accepted Answer

Data Map scanning. Microsoft Purview Data Map scanning discovers and classifies data assets across sources. Option B is wrong because Data Sharing is for sharing data, not scanning. Option C is wrong because Data Catalog is the inventory of assets, not the scanning component. Option D is wrong because Data Estate Insights provides monitoring and governance insights, not scanning.

Answer

Data Sharing

Answer

Data Catalog

Answer

Data Estate Insights

Question 10

Your organization is deploying a new application on Azure Kubernetes Service (AKS). You need to secure container access to Azure resources using managed identities. Which TWO components are required? (Choose TWO.)

Accepted Answer

Azure AD pod-managed identity (or workload identity). To secure container access using managed identities, the required components are: a supported identity assignment mechanism (such as workload identity) and a location for secret storage (like Azure Key Vault). The Microsoft Entra ID managed identity itself is provisioned separately and is not listed as an option. Therefore, the correct answers are B and D.

Answer

Pod identity (e.g., aad-pod-identity)

Answer

Azure Container Registry

Answer

Azure Firewall

Question 11

Your company uses Microsoft Intune to manage corporate devices. You need to protect company data on devices by preventing data leakage to personal apps. Which TWO policies should you configure? (Choose TWO.)

Accepted Answer

App protection policies (MAM). App protection policies (MAM) [B] are correct because they define data-loss-prevention rules at the app layer, such as preventing cut/copy/paste between managed apps and personal apps, blocking Save As to personal locations, and enforcing encryption and PIN requirements on managed apps. Conditional access policies requiring approved client apps [E] are correct because they ensure users can only access corporate resources (like Exchange Online and SharePoint) through managed, approved apps, so data cannot be opened in unmanaged personal apps. Device compliance policies [A] only evaluate device state (OS version, encryption, jailbreak) and do not control app-level data sharing. Device configuration profiles [C] configure device settings but do not prevent data leakage to personal apps. Windows Information Protection (WIP) [D] is a Windows-only feature that is being deprecated in favor of MAM and is not the general Intune solution for cross-platform app data protection.

Answer

Device compliance policies

Answer

Device configuration profiles

Answer

Windows Information Protection (WIP)

Question 12

Refer to the exhibit. You are designing an API Management instance for a production environment. The exhibit shows a snippet of an ARM template. Which security concern is most critical to address before deploying to production?

Accepted Answer

The SKU is set to Developer, which is not suitable for production.. The Developer SKU is not suitable for production due to lack of SLA and limited scale. Option A is wrong because disabling TLS 1.0/1.1 and weak ciphers is actually a security best practice. Option B is wrong because the publisher email and name are informational. Option C is wrong because the API version constraint affects feature set, not security.

Answer

Weak TLS cipher suites are enabled.

Answer

Publisher email and name are hardcoded.

Answer

The API version constraint is outdated.

Question 13

Your organization, Contoso Ltd., is a multinational company with 50,000 employees. They use Microsoft 365 E5, Azure, and Microsoft Sentinel. The security team wants to implement a data security solution that meets the following requirements:

1. All sensitive data stored in SharePoint Online and OneDrive for Business must be automatically classified and protected using sensitivity labels.
2. When a user attempts to share a file labeled 'Highly Confidential' with an external user, the action should be blocked and an alert sent to the security team.
3. The solution must detect and prevent data exfiltration from endpoints by monitoring copy/paste and print actions on sensitive data.
4. All data security events must be centralized in Microsoft Sentinel for correlation and investigation.
5. The solution must comply with regulatory requirements that mandate data retention and eDiscovery capabilities.

You need to design the data security solution. Which combination of Microsoft security components should you use?

Accepted Answer

Microsoft Purview Information Protection, Microsoft Purview DLP, and Microsoft Purview eDiscovery. Microsoft Purview Information Protection auto-labeling policies meet requirement 1. DLP policies in Purview block sharing and alert (requirement 2). Endpoint DLP in Purview monitors copy/paste/print (requirement 3). Purview audit logs are ingested into Microsoft Sentinel (requirement 4). Microsoft Purview eDiscovery and retention policies meet requirement 5. Option A is wrong because Microsoft Intune is for device management and does not provide DLP or eDiscovery, and Microsoft Entra ID is for identity and access management, not data classification or DLP. Option B is wrong because Microsoft Defender for Endpoint focuses on endpoint protection, not data classification or eDiscovery, and Microsoft Sentinel is a SIEM, not a data classification solution. Option C is wrong because Microsoft Defender for Cloud Apps is a CASB and does not provide endpoint DLP or eDiscovery, and Microsoft Entra ID does not provide DLP or eDiscovery.

Answer

Microsoft Intune and Microsoft Entra ID

Answer

Microsoft Defender for Endpoint and Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps and Microsoft Entra ID

Question 14

Your organization uses Microsoft Defender for Cloud to protect its Azure workloads. You have an application that runs on Azure Virtual Machines and uses a storage account to store sensitive data. The security team wants to detect when the storage account access keys are used from an unexpected location. What should you configure?

Accepted Answer

Enable Microsoft Defender for Storage and configure anomaly detection alerts.. Microsoft Defender for Cloud provides adaptive application controls, file integrity monitoring, and just-in-time access, but not specifically for detecting storage key usage from unexpected locations. Microsoft Defender for Storage (part of Defender for Cloud) provides anomaly detection, including unusual access patterns. You can also use Azure Monitor with alerts on storage metrics, but the most direct is Defender for Storage. Option D is correct.

Answer

Configure adaptive application controls on the storage account.

Answer

Create an Azure Monitor alert based on the 'Storage Account List Keys' operation.

Answer

Enable just-in-time VM access in Microsoft Defender for Cloud.

Question 15

A company is migrating a legacy on-premises application to Azure. The application currently uses Windows Integrated Authentication (Kerberos) and requires access to a SQL Server database on the same network. In Azure, the application will run on Azure Virtual Machines and the database will be migrated to Azure SQL Managed Instance. You need to ensure the application can authenticate to the database without storing credentials. What should you implement?

Accepted Answer

Join the virtual machine to an Azure AD Domain Services domain and configure the application to use Azure AD Kerberos authentication.. The application currently uses Windows Integrated Authentication (Kerberos) and must authenticate to Azure SQL Managed Instance without storing credentials. Joining the Azure VM to an Microsoft Entra Domain Services (Entra Domain Services) domain and configuring the application to use Microsoft Entra ID Kerberos authentication (C) preserves the Kerberos-based integrated auth model while enabling the VM to obtain a Kerberos ticket for the managed instance. Azure SQL Managed Instance supports Microsoft Entra ID Kerberos authentication, allowing Windows-integrated auth without traditional AD DS.

Answer

Store the database credentials in Azure Key Vault and retrieve them at runtime.

Answer

Use SQL authentication with a contained database user.

Answer

Create a service principal in Azure AD and grant it access to the database.