SC-100 Design security solutions for applications and data Practice Test 6 — 15 Questions

Question 1

Your company is migrating a legacy on-premises web application to Azure App Service. The application uses Windows Integrated Authentication and connects to a SQL Server database. You need to design a security solution that minimizes changes to the application code while ensuring secure authentication and data protection. What should you use to authenticate users?

Accepted Answer

Microsoft Entra Application Proxy. Option C is correct because Microsoft Entra ID Application Proxy allows legacy apps to use Entra ID authentication without modifying code, by publishing the app through the proxy. Option A is wrong because Azure AD (now Entra ID) Domain Services provides domain join but requires code changes or a separate auth flow. Option B is wrong because App Service Authentication (EasyAuth) can be configured but may require code changes for WIA. Option D is wrong because a VPN doesn't solve authentication; it just secures network access.

Answer

Microsoft Entra Domain Services

Answer

App Service Authentication (EasyAuth) with Entra ID

Answer

Site-to-Site VPN with on-premises Active Directory

Question 2

Your organization uses Microsoft Sentinel to detect threats. You need to ensure that sensitive data stored in Azure SQL Database is protected from unauthorized access by Sentinel playbooks. What should you implement?

Accepted Answer

Use a managed identity assigned to the playbook to authenticate to Azure SQL. Option A is correct because managed identities provide a secure, identity-based authentication for playbooks to access Azure SQL without storing credentials. Option B is wrong because firewall rules are network-level, not identity-based. Option C is wrong because data masking is for query results, not access control. Option D is wrong because CMK is for encryption at rest, not access control.

Answer

Enable dynamic data masking on the SQL database

Answer

Use customer-managed keys (CMK) for SQL Transparent Data Encryption

Answer

Configure Azure SQL firewall rules to allow only Sentinel IP addresses

Question 3

Your organization is designing a data protection strategy for Microsoft 365 using Microsoft Purview. You need to protect sensitive data from being shared externally via email. Which TWO capabilities should you include?

Accepted Answer

Sensitivity labels with encryption for emails and attachments. Options A and D are correct. Sensitivity labels with encryption prevent unauthorized sharing, and Data Loss Prevention (DLP) policies detect and block sharing of sensitive data. Option B is wrong because message encryption protects at rest/in transit but doesn't prevent sharing. Option C is wrong because retention labels manage data lifecycle, not sharing. Option E is wrong because Privileged Access Management controls administrative access, not end-user sharing.

Answer

Retention labels and policies

Answer

Microsoft Purview Message Encryption

Answer

Privileged Access Management (PAM)

Question 4

A company deploys a multi-tier application on Azure Kubernetes Service (AKS). The application uses Azure Key Vault to store secrets. You need to ensure that pod-level access to secrets is restricted to only the pods that require them. What should you implement?

Accepted Answer

Use the AKS Secret Store CSI Driver with pod-managed identities. Option B is correct because AKS Secret Store CSI Driver allows mounting secrets from Key Vault into specific pods using pod identity, ensuring only authorized pods can access secrets. Option A is wrong because RBAC on the Key Vault itself is too coarse. Option C is wrong because Azure Policy for AKS can enforce compliance but doesn't manage secret access. Option D is wrong because managed identity is used for pod identity but needs the CSI driver to mount secrets.

Answer

Use a managed identity for each pod to access Key Vault directly

Answer

Configure Azure RBAC on the Key Vault to restrict access to the AKS cluster

Answer

Apply Azure Policy to deny access to Key Vault from unauthorized namespaces

Question 5

Your company develops an API that will be consumed by external partners. You need to secure the API using Azure API Management (APIM). Which authentication mechanism should you recommend for partner applications?

Accepted Answer

OAuth 2.0 with Microsoft Entra ID. Option C is correct because OAuth 2.0 is the standard for delegated access and is suitable for partner applications. Option A is wrong because subscription keys are for identification, not authentication. Option B is wrong because client certificates are for server-to-server, not typical for partner apps. Option D is wrong because IP whitelisting is network-level and not secure for authentication.

Answer

Client certificates

Answer

Subscription keys

Answer

IP address whitelisting

Question 6

Your organization is designing a solution to protect sensitive data in Microsoft SharePoint Online. You need to ensure that documents containing credit card numbers are automatically encrypted when shared with external users. What should you configure?

Accepted Answer

An auto-labeling policy for sensitivity labels with encryption. Option B is correct because auto-labeling in Microsoft Purview can apply sensitivity labels that enforce encryption based on sensitive data patterns. Option A is wrong because DLP policies can block or warn but not automatically encrypt. Option C is wrong because retention labels manage lifecycle. Option D is wrong because IRM can protect but requires manual application or DLP integration, not automatic labeling.

Answer

A Data Loss Prevention (DLP) policy that blocks sharing

Answer

Information Rights Management (IRM) for SharePoint

Answer

A retention policy with a hold

Question 7

Your company is designing a zero-trust security posture for a new application in Azure. The application uses Azure Functions, Azure SQL Database, and Azure Blob Storage. You need to ensure that data in transit is encrypted and that the application can authenticate without storing secrets in code. Which THREE actions should you take?

Accepted Answer

Enable 'Enforce minimum TLS version' on the Blob Storage account. Options A, C, and E are correct. Enforcing TLS 1.2 encrypts data in transit, managed identity for Azure Functions provides secretless authentication to Azure SQL, and Enforce minimum TLS version on Blob Storage ensures encrypted connections. Option B is wrong because firewall rules don't encrypt data. Option D is wrong because CMK is for encryption at rest, not in transit.

Answer

Enable customer-managed keys (CMK) for Azure SQL Database

Answer

Configure the Azure SQL firewall to allow only the Functions IP range

Question 8

Refer to the exhibit. You are reviewing an Azure Policy definition for storage accounts. You assign this policy with effect set to 'Deny' on a resource group. Which of the following scenarios will be blocked by this policy?

Accepted Answer

Creating a storage account with blob service encryption disabled. Option B is correct because the policy denies storage accounts that do not have blob service encryption enabled. Option A is wrong because the policy checks blob service encryption, not infrastructure encryption. Option C is wrong because the policy does not check TLS version. Option D is wrong because the policy does not check network access.

Answer

Creating a storage account with a firewall set to deny all public access

Answer

Creating a storage account with TLS 1.0 enabled

Answer

Creating a storage account with infrastructure encryption disabled

Question 9

Your organization uses Microsoft Defender for Cloud to assess security posture. You need to ensure that your Azure App Service web applications are protected against common web vulnerabilities like SQL injection. What should you enable?

Accepted Answer

Web Application Firewall (WAF) on Azure Front Door. Option C is correct because Web Application Firewall (WAF) on Azure Front Door or Application Gateway protects against OWASP top 10 vulnerabilities including SQL injection. Option A is wrong because DDoS Protection protects against volumetric attacks, not web application attacks. Option B is wrong because JIT VM access reduces attack surface on VMs, not web apps. Option D is wrong because Adaptive Application Controls whitelist applications on servers, not protect against web attacks.

Answer

Just-in-time (JIT) VM access

Answer

Adaptive Application Controls

Answer

Azure DDoS Protection

Question 10

Your company uses Microsoft 365 and wants to prevent sensitive data from being copied to personal cloud storage services like Dropbox. Which TWO Microsoft Purview capabilities should you use?

Accepted Answer

Data Loss Prevention (DLP) policies in Microsoft Purview. Options B and D are correct. Endpoint DLP can block copying to personal cloud storage from devices, and DLP policies in Microsoft 365 can detect and block such actions. Option A is wrong because sensitivity labels classify but don't block actions. Option C is wrong because AIP is deprecated in favor of Purview. Option E is wrong because Cloud App Security can block downloads from cloud apps but not from endpoint to personal cloud.

Answer

Azure Information Protection (AIP) unified labeling client

Answer

Sensitivity labels

Answer

Microsoft Defender for Cloud Apps (formerly Cloud App Security)

Question 11

Your company is developing a Microsoft Teams app that accesses user profiles. You need to ensure the app only accesses minimal required data. What should you implement?

Accepted Answer

Delegated permissions with User.Read. Option D is correct because Microsoft Graph delegated permissions with least privilege ensure the app only accesses the minimum required data. Option A is wrong because app-only permissions grant broad access. Option B is wrong because admin consent grants full access. Option C is wrong because application permissions are for background services, not user context.

Answer

Admin consent for all scopes

Answer

Application permissions for Microsoft Graph

Answer

Delegated permissions with User.Read.All

Question 12

Refer to the exhibit. You are reviewing an ARM template for an Azure Function App. The function app uses a user-assigned managed identity and references a Key Vault secret for the storage connection string. The deployment fails because the function app cannot access the Key Vault secret. What is the most likely cause?

Accepted Answer

The user-assigned managed identity does not have a Key Vault access policy to get secrets. Option A is correct because the user-assigned managed identity must have a Key Vault access policy to read secrets. Option B is wrong because the secret name is 'storage-connection', not 'storage-connection-string'. Option C is wrong because the reference syntax is correct for Key Vault references. Option D is wrong because a custom DNS is not relevant.

Answer

The function app is configured with a custom DNS server that cannot resolve the Key Vault URI

Answer

The secret name in the URI does not match the actual secret name in Key Vault

Answer

The Key Vault reference syntax is incorrect; it should use '@Microsoft.KeyVault(SecretUri=...)'

Question 13

Your organization uses Microsoft Entra ID for identity and access management. You need to design a solution that allows external partners to access a specific SharePoint Online site without creating guest accounts. What should you use?

Accepted Answer

SharePoint Online external sharing with authenticated external users. Option B is correct because SharePoint Online external sharing can be configured to allow sharing with authenticated external users via Entra ID B2B collaboration, which creates guest accounts. Option A is wrong because Azure AD B2C is for customer-facing apps. Option C is wrong because Entra ID business-to-business (B2B) requires guest accounts. Option D is wrong because anonymous access is not secure for partners.

Answer

Anonymous sharing links

Answer

Microsoft Entra ID business-to-business (B2B) collaboration

Answer

Azure Active Directory B2C (now part of Entra ID)

Question 14

Refer to the exhibit. This is a risk alert from Microsoft Entra ID Identity Protection for user jdoe@contoso.com. You are designing an automated response using Microsoft Sentinel. Which condition should you use to trigger a high-severity incident?

Accepted Answer

If the user risk level is 'high'. Option D is correct because the alert has a user risk level of 'high', which indicates a compromised account. Option A is wrong because risk event types are 'unfamiliarFeatures' and 'atypicalTravel', not 'leakedCredentials'. Option B is wrong because the sign-in risk level is 'medium', not 'high'. Option C is wrong because the user risk level is 'high', not 'medium'.

Answer

If the sign-in risk level is 'high'

Answer

If the risk event types include 'leakedCredentials'

Answer

If the user risk level is 'medium'

Question 15

Your organization is implementing a secure DevOps pipeline for Azure. You need to ensure that secrets (e.g., API keys) are not stored in source code and that access to production resources is controlled. Which THREE practices should you implement?

Accepted Answer

Use Azure Key Vault to store secrets and retrieve them at deployment time. Options A, B, and D are correct. Using Azure Key Vault for secrets, managed identities for Azure resources, and Azure DevOps variable groups linked to Key Vault are all secure practices. Option C is wrong because storing secrets in pipeline variables with encryption is not as secure as Key Vault. Option E is wrong because hardcoding secrets in configuration files is insecure.

Answer

Store secrets in Azure DevOps pipeline variables with encryption enabled

Answer

Store secrets in a configuration file in a private Git repository