SC-100 Design security solutions for applications and data Practice Test 6 — 15 Questions

Question 1

Your company is designing a zero-trust security posture for a new application in Azure. The application uses Azure Functions, Azure SQL Database, and Azure Blob Storage. You need to ensure that data in transit is encrypted and that the application can authenticate without storing secrets in code. Which THREE actions should you take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable 'Enforce minimum TLS version' on the Blob Storage account. Options A, B, and C are correct. Enforcing a minimum TLS version on Blob Storage (A) and configuring the application to use TLS 1.2 or higher (B) both ensure data in transit is encrypted. Using managed identity for Azure Functions to access Azure SQL Database (C) provides secretless authentication. Option D (CMK) encrypts data at rest, not in transit. Option E (firewall IP restriction) controls network access but does not encrypt data in transit.

Answer

Enable customer-managed keys (CMK) for Azure SQL Database

Answer

Configure the Azure SQL firewall to allow only the Functions IP range

Question 2

Refer to the exhibit. You are reviewing an Azure Policy definition for storage accounts. You assign this policy with effect set to 'Deny' on a resource group. Which of the following scenarios will be blocked by this policy?

Accepted Answer

Creating a storage account with blob service encryption disabled. The policy denies storage accounts that do not have blob service encryption enabled. Option A is incorrect because network firewall settings are not evaluated by this policy. Option B is incorrect because TLS version is not evaluated. Option D is incorrect because infrastructure encryption is a separate setting from blob encryption.

Answer

Creating a storage account with a firewall set to deny all public access

Answer

Creating a storage account with TLS 1.0 enabled

Answer

Creating a storage account with infrastructure encryption disabled

Question 3

Your organization uses Microsoft Defender for Cloud to assess security posture. You need to ensure that your Azure App Service web applications are protected against common web vulnerabilities like SQL injection. What should you enable?

Accepted Answer

Web Application Firewall (WAF) on Azure Front Door. Web Application Firewall (WAF) on Azure Front Door. WAF provides centralized protection against common web vulnerabilities like SQL injection and cross-site scripting, based on OWASP top 10 rulesets. Option B (JIT VM access) reduces attack surface on VMs but does not protect web applications. Option C (Adaptive Application Controls) whitelists applications on Azure Arc-enabled servers and VMs, not web app requests. Option D (Azure DDoS Protection) mitigates volumetric network attacks, not application-layer threats.

Answer

Just-in-time (JIT) VM access

Answer

Adaptive Application Controls

Answer

Azure DDoS Protection

Question 4

Your company uses Microsoft 365 and wants to prevent sensitive data from being copied to personal cloud storage services like Dropbox. Which TWO Microsoft Purview capabilities should you use?

Accepted Answer

Data Loss Prevention (DLP) policies in Microsoft Purview. Options A and B are correct. Microsoft Purview Data Loss Prevention (DLP) policies can detect and prevent sensitive data from being shared to unauthorized locations like personal cloud storage services. Endpoint DLP extends these capabilities to endpoints, blocking copying of sensitive data to personal cloud storage from devices. Option C is wrong because Azure Information Protection (AIP) unified labeling client is deprecated and does not directly block data transfer. Option D is wrong because sensitivity labels classify and protect data but do not block copying actions. Option E is wrong because Microsoft Defender for Cloud Apps can block downloads from cloud apps but not from endpoints to personal cloud storage.

Answer

Azure Information Protection (AIP) unified labeling client

Answer

Sensitivity labels

Answer

Microsoft Defender for Cloud Apps (formerly Cloud App Security)

Question 5

Your company is developing a Microsoft Teams app that accesses user profiles. You need to ensure the app only accesses minimal required data. What should you implement?

Accepted Answer

Delegated permissions with User.Read. Delegated permissions with User.Read grant the app access to only the basic user profile (e.g., display name, email) when the user is signed in, following the principle of least privilege. Option A is wrong because admin consent for all scopes gives the app broad permissions beyond what is needed. Option B is wrong because application permissions are for background services and cannot be scoped to a single user, resulting in access to all users. Option D is wrong because User.Read.All provides access to read all user profiles, which is excessive for accessing only a single user's profile.

Answer

Admin consent for all scopes

Answer

Application permissions for Microsoft Graph

Answer

Delegated permissions with User.Read.All

Question 6

Refer to the exhibit. You are reviewing an ARM template for an Azure Function App. The function app uses a user-assigned managed identity and references a Key Vault secret for the storage connection string. The deployment fails because the function app cannot access the Key Vault secret. What is the most likely cause?

Accepted Answer

The user-assigned managed identity does not have a Key Vault access policy to get secrets. The most likely cause is that the user-assigned managed identity does not have a Key Vault access policy granting 'Get' permission for secrets. Even if the function app is correctly configured with the identity, Key Vault requires an explicit access policy to allow the identity to retrieve secrets. Option A is incorrect because DNS resolution is not relevant in this scenario. Option B is incorrect because even if the secret name were wrong, the primary issue is permissions. Option C is incorrect because the syntax used in the ARM template is correct for Key Vault references. Therefore, the correct answer is D.

Answer

The function app is configured with a custom DNS server that cannot resolve the Key Vault URI

Answer

The secret name in the URI does not match the actual secret name in Key Vault

Answer

The Key Vault reference syntax is incorrect; it should use '@Microsoft.KeyVault(SecretUri=...)'

Question 7

Your organization uses Microsoft Entra ID for identity and access management. You need to design a solution that allows external partners to access a specific SharePoint Online site without creating guest accounts. What should you use?

Accepted Answer

Anonymous sharing links. Anonymous sharing links do not require authentication and do not create guest accounts in Microsoft Entra ID. This meets the requirement of allowing external partners to access the SharePoint site without creating guest accounts. Option B (B2B collaboration) explicitly creates guest accounts. Option C (authenticated external users) also creates guest accounts because any authenticated external sharing in SharePoint creates a guest user object in Entra ID. Option D (Azure AD B2C) is designed for customer-facing applications and is not suitable for SharePoint access, and it creates user accounts in the B2C directory, not guest accounts in the tenant.

Answer

Microsoft Entra ID business-to-business (B2B) collaboration

Answer

SharePoint Online external sharing with authenticated external users

Answer

Azure Active Directory B2C (now part of Entra ID)

Question 8

Refer to the exhibit. This is a risk alert from Microsoft Entra ID Identity Protection for user jdoe@contoso.com. You are designing an automated response using Microsoft Sentinel. Which condition should you use to trigger a high-severity incident?

Accepted Answer

If the user risk level is 'high'. The risk alert shows a user risk level of 'high', indicating a compromised account. Triggering on 'high' user risk aligns with the alert's severity. Option B is wrong because the sign-in risk level is 'medium', not 'high'. Option C is wrong because the risk event types include 'unfamiliarFeatures' and 'atypicalTravel', not 'leakedCredentials'. Option D is wrong because the user risk level is 'high', not 'medium'.

Answer

If the sign-in risk level is 'high'

Answer

If the risk event types include 'leakedCredentials'

Answer

If the user risk level is 'medium'

Question 9

Your organization is designing a new application that will store sensitive customer data in Azure Cosmos DB. You need to ensure that data at rest is encrypted using a customer-managed key (CMK) stored in Azure Key Vault. What should you configure?

Accepted Answer

Configure a customer-managed key in Azure Key Vault and assign it to the Cosmos DB account.. Azure Cosmos DB supports customer-managed keys (CMK) by creating an encryption key in Azure Key Vault and associating it with the Cosmos DB account. Option A is incorrect because Transparent Data Encryption (TDE) is a feature for SQL databases, not for Cosmos DB. Option B is incorrect because Azure Storage Service Encryption (SSE) applies to Azure Blob Storage and other storage services, not Cosmos DB. Option C is incorrect because Always Encrypted is a feature for Azure SQL Database and SQL Server, not for Cosmos DB.

Answer

Enable Transparent Data Encryption (TDE) on the Cosmos DB account.

Answer

Enable Azure Storage Service Encryption (SSE) on the Cosmos DB account.

Answer

Use Always Encrypted with Azure SQL Database.

Question 10

Your company uses Microsoft Purview to classify and protect sensitive data. You need to automatically detect and protect credit card numbers in documents stored in SharePoint Online. Which solution should you implement?

Accepted Answer

Create a Data Loss Prevention (DLP) policy to detect credit card numbers and block sharing.. Microsoft Purview Data Loss Prevention (DLP) policies can automatically detect sensitive info types like credit card numbers and apply protection actions such as blocking sharing. Option A is wrong because Azure Information Protection is primarily for labeling and encryption, not automatic detection of specific data patterns. Option B is wrong because sensitivity labels require manual application or auto-labeling rules, which are less direct for this scenario than a DLP policy. Option D is wrong because Microsoft Defender for Cloud Apps focuses on cloud app security and shadow IT, not document classification within SharePoint Online.

Answer

Configure Azure Information Protection to automatically apply protection.

Answer

Apply a sensitivity label that encrypts documents with credit card numbers.

Answer

Use Microsoft Defender for Cloud Apps to scan documents for credit card numbers.

Question 11

You are designing a microservices application running on Azure Kubernetes Service (AKS). You need to ensure that secrets (e.g., API keys, connection strings) are securely stored and automatically rotated without application downtime. What is the recommended approach?

Accepted Answer

Use Azure Key Vault with the Secrets Store CSI driver to mount secrets as volumes and enable rotation.. The Azure Key Vault Provider for Secrets Store CSI Driver allows pods to mount secrets from Key Vault as a volume, and the driver handles rotation automatically without requiring pod restart. Option A is incorrect because Azure App Configuration is primarily for managing application configuration settings, not secrets; while it can reference Key Vault secrets, it does not provide automatic rotation of those secrets within the application without additional mechanisms. Option B is incorrect because Kubernetes Secrets are only base64-encoded, not encrypted at rest by default, and rotating them requires manual intervention or additional tooling, often leading to application restarts. Option D is incorrect because injecting secrets as environment variables from Key Vault using pod identity is possible, but environment variables are typically read at pod startup and do not refresh automatically when secrets are rotated, requiring a pod restart to pick up new values; the CSI driver volume mount approach is more suitable for automatic rotation without downtime.

Answer

Store secrets in Azure App Configuration with key vault references.

Answer

Store secrets as Kubernetes Secrets and use a controller to rotate them.

Answer

Inject secrets as environment variables from Azure Key Vault using a pod identity.

Question 12

Your organization uses Microsoft Entra ID for identity and access management. You are developing a web application that needs to access Microsoft Graph API on behalf of the signed-in user. Which authentication flow should you implement?

Accepted Answer

Authorization Code Flow with PKCE. The Authorization Code Flow with PKCE is the recommended flow for web applications that need to access Microsoft Graph API on behalf of the signed-in user. It is secure and supports user delegation. Option A is wrong because Implicit Flow is legacy and less secure, no longer recommended. Option B is wrong because Client Credentials Flow is for daemon or service applications, not on behalf of a user. Option D is wrong because Device Code Flow is for devices without browsers, not for web applications.

Answer

Implicit Flow

Answer

Client Credentials Flow

Answer

Device Code Flow

Question 13

You are designing a solution to protect an Azure App Service web application from common web attacks like SQL injection and cross-site scripting. What should you implement?

Accepted Answer

Azure Web Application Firewall (WAF) policy on Azure Front Door. Azure Web Application Firewall (WAF) on Azure Front Door provides application-layer protection against common web attacks such as SQL injection and cross-site scripting (XSS). Option A is incorrect because Azure Firewall is a network-level firewall that filters traffic based on IP/port, not application payloads. Option B is incorrect because Azure DDoS Protection mitigates distributed denial-of-service attacks, not application-layer attacks. Option D is incorrect because Network Security Groups (NSGs) filter traffic at the subnet level based on rules, not at the application layer.

Answer

Azure Firewall

Answer

Azure DDoS Protection

Answer

Network Security Groups (NSGs) on the subnet

Question 14

Your company uses Microsoft Purview to manage data governance. You need to create a data classification rule that scans Azure Data Lake Storage for personally identifiable information (PII) such as email addresses. The rule must also apply a sensitivity label automatically. Which approach should you use?

Accepted Answer

Create a custom scan rule in Microsoft Purview and configure auto-labeling.. Microsoft Purview allows you to create custom scan rules that detect sensitive data types like PII (e.g., email addresses) in Azure Data Lake Storage, and then automatically apply sensitivity labels via auto-labeling policies. Option A is incorrect because Azure Policy is used for enforcing compliance rules, not for scanning data content. Option C is incorrect because while Power Automate can be used for automation, it is not the primary method for data classification and labeling within Purview. Option D is incorrect because Microsoft Defender for Cloud focuses on security posture and threat protection, not data classification.

Answer

Create an Azure Policy to detect and label PII.

Answer

Use a Power Automate flow to scan files and apply labels.

Answer

Use Microsoft Defender for Cloud to scan for PII.

Question 15

You are designing a CI/CD pipeline for a containerized application using Azure DevOps. You need to ensure that container images are scanned for vulnerabilities before being deployed to production. Which service should you integrate?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (formerly Azure Security Center) can scan container images in Azure Container Registry for vulnerabilities. Option A is wrong because Azure Policy can enforce compliance but not scan images. Option B is wrong because Azure Key Vault is for secrets management. Option D is wrong because Azure Monitor is for monitoring, not scanning.

Answer

Azure Policy

Answer

Azure Key Vault

Answer

Azure Monitor