SC-100 Design security solutions for applications and data Practice Test 6 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel as its SIEM. You need to collect logs from a custom line-of-business application that does not support standard syslog or Windows Event Log. The application writes logs to a text file on a Windows server. What is the most efficient way to ingest these logs into Microsoft Sentinel?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install the Log Analytics Agent (deprecated, but still available) on the server and configure custom log collection.. The Log Analytics Agent (formerly Microsoft Monitoring Agent) can be configured to collect custom text logs by specifying the log file path and a custom parsing rule. This is the most direct and efficient method because it reads the text file directly from the server with minimal overhead.

- Option A is incorrect because syslog is not supported by Windows natively and requires additional infrastructure; the application would need to be modified to output syslog, which is inefficient.
- Option B is incorrect because using Event Hubs adds complexity and cost; the application would need to write to Event Hubs, requiring code changes.
- Option C is incorrect because the Azure Monitor Agent does not natively support collecting custom text logs; it is designed for structured data sources like performance counters and Windows events.

Answer

Configure the application to send logs to a syslog server and use a syslog connector.

Answer

Set up a Azure Event Hubs and have the application write logs to Event Hubs.

Answer

Use the Azure Monitor Agent to collect the text file via a custom data source.

Question 2

Your organization uses Azure DevOps for CI/CD. You need to ensure that secrets (e.g., API keys) used in pipeline tasks are securely stored and accessed. The security requirements are: secrets must be encrypted at rest, access must be audited, and secrets must be automatically rotated. Which THREE services or features should you use? (Choose three.)

Accepted Answer

Azure Key Vault access policy to grant permissions.. Azure Key Vault (C) is the correct place to store secrets because it encrypts secrets at rest using FIPS 140-2 validated HSMs/software keys and provides centralized secret management. Azure Key Vault access policy (A) is correct because it grants explicit permissions (get, list, set, etc.) to the pipeline's identity, and every access is logged in Azure Monitor/diagnostic logs for auditing. Azure Key Vault key rotation policy (E) is correct because it enables automatic rotation of keys/secrets on a defined schedule, satisfying the automatic rotation requirement. Azure DevOps Variable Groups (B) can hold secrets but they are not a dedicated vault with HSM-backed encryption, granular access policies, or automatic rotation, so they do not meet all three requirements. Microsoft Entra ID service principal (D) is an identity used to authenticate to Key Vault, but it is not itself a service or feature that stores, audits, or rotates secrets, so it is not one of the three required selections.

Answer

Azure DevOps Variable Groups to store secrets.

Answer

Azure Active Directory service principal to access secrets.

Question 3

A company is deploying a new API management solution using Azure API Management. The APIs will be consumed by external partners. Security requirements include: protecting against OWASP Top 10 attacks, throttling requests per subscription, and validating JSON schemas. Which TWO policies should you configure? (Choose two.)

Accepted Answer

Validate content policy to check JSON schema.. Option A, the validate content policy, is correct because it enforces JSON schema validation on request or response bodies in Azure API Management, directly satisfying the requirement to validate JSON schemas. Option B, the rate limit policy, is correct because it throttles the number of calls per subscription key over a specified time window, which meets the requirement to throttle requests per subscription. Together these policies address the stated schema validation and per-subscription throttling needs. Option C (validate JWT) only verifies token authenticity and claims, not JSON schema or throttling, so it does not fulfill the stated requirements. Option D (IP filter) restricts callers by IP address but does not validate schemas or throttle per subscription. Option E (cross domain) merely configures CORS headers and does not address schema validation or throttling. Note that OWASP Top 10 protection is typically handled by other means such as the validate content policy for injection-style payloads and rate limiting for abuse, but among the listed options only A and B map directly to the explicit requirements.

Answer

Validate JWT policy to ensure tokens are valid.

Answer

IP filter policy to restrict access to partner IPs.

Answer

Cross domain policy to allow CORS.

Question 4

A company uses Microsoft Defender for Cloud Apps to protect SaaS applications. The security team receives alerts about suspicious file downloads from a specific user. They want to automatically block the user's account when the risk score exceeds 80. What should they configure?

Accepted Answer

Create an access policy. The correct option is C, Create an access policy. In Microsoft Defender for Cloud Apps, access policies are used to monitor and automatically remediate user activity based on risk, including blocking a user's account when their risk score exceeds a defined threshold such as 80. This matches the scenario's requirement for automatic account blocking triggered by a risk score. Conditional Access app control (A) and session policies (B) govern real-time session behavior and proxy actions, not automatic account blocking based on risk score. App governance policies (D) apply to OAuth app permissions and behavior, not user risk-based account blocking.

Answer

Configure Conditional Access app control

Answer

Create a session policy

Answer

Create an app governance policy

Question 5

A retail company uses Microsoft Defender for APIs to protect its online store API. The security team notices unusual API calls from an IP address that is not in the allowed list. They want to block this IP address for 24 hours. What should they configure?

Accepted Answer

Update the API collection. Updating the API collection (Option C) in Microsoft Defender for APIs allows you to apply a security policy, such as IP restrictions, to the API collection. This enables blocking a specific IP address for a defined period. Option D (rate-limiting rule) is not a feature of Defender for APIs; rate-limiting is handled by Azure API Management policies, not directly by Defender for APIs. Option A (API schema validation) validates request formats, not IP addresses. Option B (authentication settings) controls token verification, not IP blocking.

Answer

Configure API schema validation

Answer

Modify the authentication settings

Answer

Create a rate-limiting rule

Question 6

You are designing a secure CI/CD pipeline for a web application deployed to Azure Kubernetes Service (AKS). The security team requires that container images are scanned for vulnerabilities before deployment. Which two services should you integrate?

Accepted Answer

Microsoft Defender for Containers and Azure Container Registry. Microsoft Defender for Containers integrates with ACR to scan images. Option A is wrong because Azure Policy can enforce rules but does not scan images. Option B is wrong because Azure DevOps does not scan images natively. Option D is wrong because Azure Key Vault stores secrets.

Answer

Azure DevOps and Azure Key Vault

Answer

Azure Policy and Azure DevOps

Answer

Azure Key Vault and Azure Container Registry

Question 7

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Exchange Online. The compliance team wants to prevent users from sending emails containing Social Security numbers to external recipients. What should you configure?

Accepted Answer

Create a DLP policy with the condition 'Content contains sensitive info type' and action 'Block the message'. A DLP policy can detect sensitive info types and block the email. Option B is wrong because retention labels are for data retention, not blocking. Option C is wrong because mail flow rules (transport rules) can do similar but DLP is the recommended approach. Option D is wrong because sensitivity labels are for classification, not blocking.

Answer

Configure a retention label for emails

Answer

Create a mail flow rule in Exchange admin center

Answer

Apply a sensitivity label to all emails

Question 8

Which TWO data protection mechanisms should you implement to protect data at rest in Azure SQL Database?

Accepted Answer

Transparent Data Encryption (TDE). Transparent Data Encryption (TDE) [CORRECT] is correct because it performs real-time encryption and decryption of the database, associated backups, and transaction log files at rest using a symmetric key protected by a certificate stored in Azure Key Vault or the service-managed key store, directly satisfying the 'data at rest' requirement. Always Encrypted [CORRECT] is also correct because it encrypts sensitive columns at rest and keeps the keys client-side, so data is never exposed in plaintext to the database engine, storage, or backups, protecting data at rest at the column level. Azure Policy (B) is a governance/compliance tool for enforcing organizational rules, not a data encryption mechanism. Role-Based Access Control (C) governs authorization and access to resources, not encryption of stored data. Azure Firewall (D) is a network security control that filters traffic, which protects data in transit rather than at rest.

Answer

Azure Policy

Answer

Role-Based Access Control (RBAC)

Answer

Azure Firewall

Question 9

Your organization uses Microsoft Defender for Cloud Apps to monitor shadow IT. You discover that employees are using a third-party file sharing app that is not sanctioned. The security team wants to block access to this app from managed devices and require authentication for unmanaged devices. You need to configure the appropriate controls in Defender for Cloud Apps. What should you do?

Accepted Answer

Create an access policy to block the app on unmanaged devices and require authentication on managed devices.. It uses access policies to block unmanaged devices and require authentication, which aligns with the requirement. Option A is wrong because session policies monitor but do not block. Option B is wrong because app governance policies manage app permissions. Option D is wrong because DLP policies focus on data protection.

Answer

Create a session policy that monitors file uploads to the app.

Answer

Create an app governance policy to restrict the app's permissions.

Answer

Configure a DLP policy to prevent sharing of sensitive data through the app.

Question 10

Your company, Fabrikam, is a global financial services firm that handles sensitive customer data. You are designing a security solution for a new customer-facing web application that processes credit card transactions. The application will be deployed on Azure Kubernetes Service (AKS) and will use Azure SQL Database for data storage. Compliance requirements include PCI DSS and GDPR. You need to ensure that data at rest and in transit is encrypted, and that access to the database is tightly controlled. You plan to use Azure Key Vault for managing encryption keys. Which combination of actions should you implement?

Accepted Answer

Enable TDE with a customer-managed key in Azure Key Vault, use Always Encrypted for sensitive columns, enforce TLS 1.2, and use Azure AD managed identities for authentication with a firewall rule to allow only the AKS cluster's outbound IP.. It combines all required controls: TDE with a customer-managed key (CMK) in Azure Key Vault satisfies PCI DSS key management requirements, Always Encrypted protects sensitive columns even from DBAs, TLS 1.2 secures data in transit, Microsoft Entra ID managed identities eliminate credential storage, and a firewall rule restricting to the AKS outbound IP enforces network-level access control. This is the defense-in-depth approach SC-100 expects for regulated workloads.

Answer

Enable TDE with a customer-managed key stored in the application's configuration file, enforce TLS 1.2, and use Azure AD authentication.

Answer

Implement application-level encryption for credit card data, enforce TLS 1.2, and use Azure AD managed identities with no database firewall rules.

Answer

Enable Transparent Data Encryption (TDE) with a service-managed key, enforce TLS 1.0, and use SQL authentication.

Question 11

Contoso, a healthcare provider, is deploying a new patient portal on Azure App Service that stores electronic health records (EHR) in Azure Cosmos DB for NoSQL. The solution must comply with HIPAA and HITRUST. You need to ensure that data is encrypted at rest and in transit, and that access is restricted based on user roles. Cosmos DB must be configured with a private endpoint to prevent public internet access. You plan to use Azure Key Vault to manage encryption keys. Additionally, the application will access Cosmos DB using a system-assigned managed identity. Which of the following is the most complete and secure design?

Accepted Answer

Enable encryption at rest using a customer-managed key in Azure Key Vault, enforce TLS 1.2, configure a private endpoint for Cosmos DB, and grant the managed identity access via Azure RBAC with a custom role that allows read/write to specific containers.. Option D is the most complete and secure design because it uses customer-managed keys in Azure Key Vault for encryption at rest, which provides greater control and meets strict compliance requirements like HIPAA and HITRUST. It also enforces TLS 1.2 for encryption in transit, uses a private endpoint to eliminate public internet exposure, and grants the managed identity access via Azure RBAC with a custom role that follows least privilege by allowing read/write only to specific containers.

Answer

Enable encryption at rest using service-managed keys, enforce TLS 1.2, configure a service endpoint for Cosmos DB, and grant the managed identity access using Cosmos DB built-in roles (e.g., Cosmos DB Built-in Data Contributor).

Answer

Disable encryption at rest to improve performance, enforce TLS 1.2, configure a private endpoint, and use the managed identity with a read-write key in Azure Key Vault.

Answer

Enable encryption at rest using service-managed keys, enforce TLS 1.2, configure a firewall to allow only the App Service outbound IP, and use read-write keys in application settings.

Question 12

A multinational retail company, Northwind Traders, is building a new e-commerce platform on Azure. The platform includes a public-facing API built on Azure API Management (APIM) that processes orders containing personal data (PII). The company uses Microsoft Entra ID for identity management. You need to design a security solution that protects the API from common web vulnerabilities (e.g., SQL injection, XSS) and ensures that only authenticated users with the appropriate role can place orders. Additionally, you need to log and monitor all API requests for security auditing. Which combination of services should you use?

Accepted Answer

Use Azure API Management with built-in WAF, configure OAuth 2.0 authorization with Microsoft Entra ID, and enable Azure Monitor and Log Analytics for logging and alerting.. Azure API Management (APIM) can integrate with Azure Web Application Firewall (WAF) via Application Gateway or Front Door to protect against OWASP top 10 threats like SQL injection and XSS. However, APIM itself does not have a built-in WAF; but in this option, it is implied that WAF is applied at the APIM level (typically via policy or integration). More importantly, OAuth 2.0 authorization with Microsoft Entra ID ensures that only authenticated users with the appropriate role can place orders, and enabling Azure Monitor and Log Analytics provides comprehensive logging, monitoring, and alerting for security auditing. Option A is wrong because Azure Firewall operates at the network layer and does not protect against application-layer attacks, client certificate authentication provides transport security but not authorization, and Azure Monitor alone lacks the query and alerting capabilities of Log Analytics. Option C is wrong because IP whitelisting does not authenticate users or enforce role-based access, and sending logs to a storage account does not enable real-time monitoring or alerting. Option D is wrong because IP whitelisting is insufficient for authentication/authorization, and while Azure Front Door with WAF provides some protection, the lack of OAuth 2.0 and Entra ID integration means authorization is not properly enforced; also, Microsoft Sentinel is a SIEM and not primarily a logging destination for API requests.

Answer

Use Azure Firewall to filter traffic, implement client certificate authentication in APIM, and use Azure Monitor for logging.

Answer

Use Azure Application Gateway with WAF in front of APIM, configure IP whitelisting on APIM, and enable diagnostic settings to send logs to a storage account.

Answer

Use Azure Front Door with WAF in front of APIM, configure IP whitelisting on APIM, and use Microsoft Sentinel for logging.

Question 13

A software company, SouthRidge, is deploying a multi-tier application on Azure Virtual Machines. The web tier runs IIS, the application tier runs a .NET application, and the data tier runs SQL Server. You need to ensure that all traffic between tiers is encrypted, and that the application tier can access the database using a managed identity. The solution should also include a web application firewall (WAF) to protect the web tier from common attacks. Which of the following designs should you use?

Accepted Answer

Use IPsec encryption between tiers, deploy Azure Application Gateway with WAF in front of the web tier, and use a managed identity for the application tier to access SQL Server.. It provides encryption between tiers via IPsec, WAF for web protection, and managed identity for database access. Option A is wrong because application-level encryption is complex and not standard. Option B is wrong because SSL/TLS termination at the load balancer means traffic inside the VNet is unencrypted. Option C is wrong because the web tier should not have direct database access; application tier should.

Answer

Use application-level encryption between tiers, deploy Azure Application Gateway with WAF in front of the web tier, and use a service principal to access SQL Server.

Answer

Use SSL/TLS termination at the Azure Load Balancer, deploy Azure Front Door with WAF, and use a managed identity for the web tier to access SQL Server.

Answer

Use IPsec encryption between tiers, deploy Azure Application Gateway with WAF, and use a managed identity for the web tier to access SQL Server.

Question 14

A hospital, Contoso Health, is deploying an Azure API Management (APIM) instance to expose healthcare APIs that comply with HIPAA. The APIs are hosted on Azure Functions and Azure Logic Apps. You need to design a security solution that includes: (1) authentication and authorization using Microsoft Entra ID, (2) protection against OWASP top 10 threats, (3) encryption of sensitive data in transit and at rest, and (4) logging and monitoring of all API calls. Which THREE of the following should you implement?

Accepted Answer

Configure OAuth 2.0 authorization with Microsoft Entra ID in APIM.. The stem requires four security capabilities: (1) authentication/authorization with Microsoft Entra ID, (2) protection against OWASP Top 10, (3) encryption in transit and at rest, and (4) logging and monitoring. Option B fulfills capability 1, Option D fulfills capability 2, and Option E fulfills capability 4. Encryption (capability 3) is already provided by Azure APIM via TLS for transit and Azure Storage Service Encryption for at rest, so it does not require a separate selection from the listed options. Option A does not provide user authentication/authorization, and Option C provides client certificate authentication but does not satisfy the Entra ID-based authentication requirement and is not needed for encryption. Therefore, the correct selections are B, D, and E.

Answer

Configure IP whitelisting on APIM to restrict access to known IP addresses.

Answer

Configure mutual TLS (mTLS) authentication with client certificates.

Question 15

Your organization, Contoso Ltd., is a multinational financial services company that handles sensitive customer financial data. They are migrating a critical loan origination application from on-premises to Azure Kubernetes Service (AKS). The application uses SQL Server on Azure VMs for data storage. Compliance requirements mandate encryption at rest and in transit, and data classification labels must be applied automatically to all financial documents stored in Azure Blob Storage. The security team wants to use Microsoft Defender for Cloud to monitor for misconfigurations and threats. You need to design a security solution for the application and data that meets these requirements. Which of the following actions should you take first?

Accepted Answer

Deploy Azure Front Door with WAF policies in front of the loan origination application.. Deploying Azure Front Door with WAF policies is the first action that directly addresses multiple requirements: it enforces HTTPS for encryption in transit, integrates with Microsoft Defender for Cloud for monitoring web application threats and misconfigurations, and provides a scalable entry point for the loan origination application. While data classification for Blob Storage and encryption at rest are separate tasks, securing the front door is a critical initial step in the migration. Option A (Application Proxy) is for remote access, which is not required. Option C (VPN Gateway) provides site-to-site connectivity, not relevant for application security. Option D (Domain Services) extends authentication but does not address the specified security controls.

Answer

Use Microsoft Entra Application Proxy to publish the loan origination application for remote access.

Answer

Configure Azure VPN Gateway to allow site-to-site VPN connections from employee home offices.

Answer

Deploy Microsoft Entra Domain Services to extend the on-premises domain to Azure for authentication.