SC-100 Design security solutions for applications and data Practice Test 7 — 15 Questions

Question 1

Your organization is designing a new application that will store sensitive customer data in Azure Cosmos DB. You need to ensure that data at rest is encrypted using a customer-managed key (CMK) stored in Azure Key Vault. What should you configure?

Accepted Answer

Configure a customer-managed key in Azure Key Vault and assign it to the Cosmos DB account.. Option A is correct because Azure Cosmos DB supports CMK by creating an encryption key in Azure Key Vault and associating it with the Cosmos DB account. Option B is wrong because Transparent Data Encryption (TDE) is for SQL databases, not Cosmos DB. Option C is wrong because Always Encrypted is for SQL Server. Option D is wrong because Azure Storage Service Encryption is for storage accounts, not Cosmos DB.

Answer

Enable Transparent Data Encryption (TDE) on the Cosmos DB account.

Answer

Enable Azure Storage Service Encryption (SSE) on the Cosmos DB account.

Answer

Use Always Encrypted with Azure SQL Database.

Question 2

Your company uses Microsoft Purview to classify and protect sensitive data. You need to automatically detect and protect credit card numbers in documents stored in SharePoint Online. Which solution should you implement?

Accepted Answer

Create a Data Loss Prevention (DLP) policy to detect credit card numbers and block sharing.. Option B is correct because Microsoft Purview Data Loss Prevention (DLP) policies can automatically detect sensitive info types like credit card numbers and apply protection actions. Option A is wrong because Sensitivity labels require manual application or can be auto-labeled but DLP is more direct for detection. Option C is wrong because Microsoft Defender for Cloud Apps focuses on cloud app security, not document classification. Option D is wrong because Azure Information Protection (now part of Purview) is for labeling, not automatic detection of specific data patterns.

Answer

Configure Azure Information Protection to automatically apply protection.

Answer

Apply a sensitivity label that encrypts documents with credit card numbers.

Answer

Use Microsoft Defender for Cloud Apps to scan documents for credit card numbers.

Question 3

You are designing a microservices application running on Azure Kubernetes Service (AKS). You need to ensure that secrets (e.g., API keys, connection strings) are securely stored and automatically rotated without application downtime. What is the recommended approach?

Accepted Answer

Use Azure Key Vault with the Secrets Store CSI driver to mount secrets as volumes and enable rotation.. Option C is correct because using Azure Key Vault with the Secrets Store CSI driver allows pods to mount secrets as volumes, and rotation is handled by the driver. Option A is wrong because Kubernetes Secrets are base64-encoded, not encrypted by default. Option B is wrong because storing secrets in environment variables is less secure and harder to rotate. Option D is wrong because Azure App Configuration is for configuration, not secrets management.

Answer

Store secrets in Azure App Configuration with key vault references.

Answer

Store secrets as Kubernetes Secrets and use a controller to rotate them.

Answer

Inject secrets as environment variables from Azure Key Vault using a pod identity.

Question 4

Your organization uses Microsoft Entra ID for identity and access management. You are developing a web application that needs to access Microsoft Graph API on behalf of the signed-in user. Which authentication flow should you implement?

Accepted Answer

Authorization Code Flow with PKCE. Option B is correct because the Authorization Code Flow with PKCE is the recommended flow for web applications that need to access APIs on behalf of the user. Option A is wrong because Client Credentials Flow is for daemon applications, not on behalf of a user. Option C is wrong because Device Code Flow is for devices without browsers. Option D is wrong because Implicit Flow is legacy and less secure.

Answer

Implicit Flow

Answer

Client Credentials Flow

Answer

Device Code Flow

Question 5

You are designing a solution to protect an Azure App Service web application from common web attacks like SQL injection and cross-site scripting. What should you implement?

Accepted Answer

Azure Web Application Firewall (WAF) policy on Azure Front Door. Option A is correct because Azure Web Application Firewall (WAF) with Application Gateway or Front Door protects against SQL injection and XSS. Option B is wrong because Network Security Groups (NSGs) filter network traffic, not application layer. Option C is wrong because Azure DDoS Protection protects against DDoS, not web attacks. Option D is wrong because Azure Firewall is a network firewall, not a web application firewall.

Answer

Azure Firewall

Answer

Azure DDoS Protection

Answer

Network Security Groups (NSGs) on the subnet

Question 6

Your company uses Microsoft Purview to manage data governance. You need to create a data classification rule that scans Azure Data Lake Storage for personally identifiable information (PII) such as email addresses. The rule must also apply a sensitivity label automatically. Which approach should you use?

Accepted Answer

Create a custom scan rule in Microsoft Purview and configure auto-labeling.. Option C is correct because Microsoft Purview has built-in scan rules for sensitive data types and can auto-label. Option A is wrong because Azure Policy is for compliance, not scanning. Option B is wrong because Microsoft Defender for Cloud is for security posture. Option D is wrong because custom Power Automate flows are not the primary method for classification.

Answer

Create an Azure Policy to detect and label PII.

Answer

Use a Power Automate flow to scan files and apply labels.

Answer

Use Microsoft Defender for Cloud to scan for PII.

Question 7

You are designing a CI/CD pipeline for a containerized application using Azure DevOps. You need to ensure that container images are scanned for vulnerabilities before being deployed to production. Which service should you integrate?

Accepted Answer

Microsoft Defender for Cloud. Option B is correct because Microsoft Defender for Cloud (formerly Azure Security Center) can scan container images in Azure Container Registry for vulnerabilities. Option A is wrong because Azure Policy can enforce compliance but not scan images. Option C is wrong because Azure Key Vault is for secrets. Option D is wrong because Azure Monitor is for monitoring, not scanning.

Answer

Azure Policy

Answer

Azure Key Vault

Answer

Azure Monitor

Question 8

Your organization is adopting Microsoft Copilot for Microsoft 365. You need to ensure that Copilot respects the existing sensitivity labels when processing data. What should you configure?

Accepted Answer

Configure sensitivity labels in Microsoft Purview Information Protection.. Option A is correct because Microsoft Purview Information Protection sensitivity labels are respected by Microsoft Copilot. Option B is wrong because DLP policies are for data loss prevention, not labeling. Option C is wrong because Retention labels are for retention, not sensitivity. Option D is wrong because sensitivity labels are the correct solution.

Answer

Create Data Loss Prevention (DLP) policies.

Answer

Use Azure Information Protection.

Answer

Apply retention labels to documents.

Question 9

You are designing a solution for an Azure SQL Database that stores sensitive financial data. The compliance team requires that all queries are audited and that access to sensitive columns is restricted for certain users. What should you implement?

Accepted Answer

Use Always Encrypted for sensitive columns and enable Azure SQL Auditing.. Option D is correct because using Always Encrypted protects sensitive columns at rest and in transit, and auditing via Azure SQL Auditing meets compliance. Option A is wrong because TDE encrypts the entire database, not columns. Option B is wrong because Dynamic Data Masking masks data but does not restrict access. Option C is wrong because Row-Level Security restricts rows, not columns.

Answer

Enable Transparent Data Encryption (TDE) and SQL Server Audit.

Answer

Use Dynamic Data Masking and SQL Server Audit.

Answer

Implement Row-Level Security (RLS) and enable audit.

Question 10

You need to design a secure solution for a web application that authenticates users via Microsoft Entra ID and calls a downstream API. Which TWO should you implement to secure the application? (Choose TWO.)

Accepted Answer

Use the OAuth 2.0 authorization code flow with PKCE.. B and C are correct. Using OAuth 2.0 authorization code flow (with PKCE) is the recommended authentication flow for web apps. Storing secrets in Azure Key Vault ensures they are securely managed. Option A is wrong because the client credentials flow is for server-to-server, not on behalf of users. Option D is wrong because storing secrets in configuration files is insecure. Option E is wrong because shared access signatures (SAS) are for storage, not API authentication.

Answer

Store application secrets in app configuration files.

Answer

Use the OAuth 2.0 client credentials flow.

Answer

Use shared access signatures (SAS) for API authentication.

Question 11

Your organization uses Microsoft Purview to protect sensitive data. You need to implement a solution that automatically detects and protects personally identifiable information (PII) in Microsoft 365. Which THREE should be part of your solution? (Choose THREE.)

Accepted Answer

Microsoft Purview Information Protection scanner. B, C, and E are correct. Microsoft Purview Data Loss Prevention (DLP) policies can detect PII and apply actions. Sensitivity labels can classify data and enforce protection. Microsoft Purview Information Protection (formerly Azure Information Protection) scanners can scan on-premises data. Option A is wrong because Microsoft Defender for Cloud is for cloud security posture, not data classification. Option D is wrong because Azure Policy is for resource configuration, not data scanning.

Answer

Azure Policy

Answer

Microsoft Defender for Cloud

Question 12

You are designing an API management solution using Azure API Management. Which TWO should you implement to protect the API from unauthorized access? (Choose TWO.)

Accepted Answer

Implement OAuth 2.0 authorization with Microsoft Entra ID.. A and D are correct. Subscription keys are a basic mechanism to authenticate callers. OAuth 2.0 is a standard authorization framework integrated with Azure API Management. Option B is wrong because client certificates are for mutual TLS, not a primary authentication method. Option C is wrong because IP filtering is for restricting IP ranges, not authentication. Option E is wrong because CORS is for cross-origin requests, not authentication.

Answer

Use client certificates for authentication.

Answer

Enable Cross-Origin Resource Sharing (CORS).

Answer

Restrict access by IP address only.

Question 13

Refer to the exhibit. You are deploying an Azure Storage container for storing compliance records. The ARM template snippet above configures the container. Which statement accurately describes the configuration?

Accepted Answer

Blobs cannot be modified or deleted for 365 days after creation.. Option D is correct. The snippet sets publicAccess to 'None', so no anonymous access is allowed. It enables immutable storage with versioning and sets an immutability period of 365 days, meaning blobs cannot be deleted or modified for 365 days after creation. Option A is wrong because public access is set to None. Option B is wrong because allowProtectedAppendWrites is false, so append blobs cannot be written. Option C is wrong because versioning is enabled.

Answer

The container allows protected append writes.

Answer

Blob versioning is disabled for the container.

Answer

The container allows anonymous read access.

Question 14

Refer to the exhibit. You are auditing an Azure subscription. The Azure Policy assignment above is targeting a resource group. The policy definition ID corresponds to a built-in policy that audits if SQL databases have transparent data encryption (TDE) enabled. What is the effect of this policy assignment?

Accepted Answer

The policy audits SQL databases for TDE and marks non-compliant resources.. Option B is correct. The policy assignment has enforcementMode set to 'Default', which means it will audit and enforce the policy (e.g., mark non-compliant resources). If enforcementMode were 'DoNotEnforce', it would only audit. Option A is wrong because enforcementMode is not set to DoNotEnforce. Option C is wrong because the policy does not automatically enable TDE; it only audits. Option D is wrong because the scope is a resource group, not an entire management group.

Answer

The policy automatically enables TDE on non-compliant SQL databases.

Answer

The policy is only reported as audit, not enforced.

Answer

The policy applies to all resources in the management group.

Question 15

Refer to the exhibit. You are investigating a security incident in Microsoft Sentinel. The KQL query above is used to identify potential brute-force attacks. What does the query return?

Accepted Answer

A list of user accounts and computers where the account has more than 5 failed logins in the last 24 hours.. Option C is correct. The query filters SecurityEvent for user accounts (AccountType == 'User') in the last 24 hours, groups by Account and Computer, counts the number of events (FailedLogins), and then filters to only those accounts with more than 5 failed logins. Option A is wrong because it returns both Account and Computer. Option B is wrong because it does not return successful logins. Option D is wrong because it counts per account and computer, not just per computer.

Answer

A list of computers with more than 5 failed logins from any account.

Answer

A list of user accounts with more than 5 failed logins across all computers.

Answer

A list of user accounts with more than 5 successful logins in the last 24 hours.