SC-100 Design security solutions for applications and data Practice Test 7 — 15 Questions

Question 1

You are the security architect for a healthcare company that stores patient records in an Azure Storage account. The records must be encrypted at rest with customer-managed keys, and you need to ensure that if the key is revoked, the data becomes inaccessible. You also need to meet a compliance requirement that the encryption key must be stored in a hardware security module (HSM) and rotated every 90 days. Which combination of Azure services and configurations should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Azure Key Vault Managed HSM to store the key, configure the storage account to use customer-managed keys, and set up automatic key rotation with a 90-day rotation policy.. The requirement for customer-managed keys stored in an HSM and rotated every 90 days points to Azure Key Vault Managed HSM. Managed HSM provides hardware-backed keys that meet compliance. Configuring the storage account to use these keys ensures encryption at rest with customer control. Automatic rotation policy satisfies the rotation requirement. Revoking the key in Managed HSM renders the data inaccessible, meeting the revocation requirement.

Answer

Use Azure Storage Service Encryption with Microsoft-managed keys, and enable infrastructure encryption for double encryption.

Answer

Use Azure Disk Encryption with BitLocker keys stored in Azure Key Vault, and configure a key rotation policy using Azure Automation.

Answer

Use Azure Key Vault (standard tier) to store the key, configure the storage account to use customer-managed keys, and enable soft-delete and purge protection.

Question 2

Your organization stores sensitive engineering drawings in Azure Blob Storage. The security team wants to ensure that any external sharing link generated for these blobs expires within 24 hours, cannot be extended, and cannot be used after a user's access is revoked. You need to recommend the sharing mechanism. What should you recommend?

Accepted Answer

Use a user delegation SAS token with a short expiry and a stored access policy.. The requirements demand a sharing token that is short-lived, cannot be extended, and is tied to an identity so it can be revoked. A user delegation SAS backed by a stored access policy provides exactly that: Microsoft Entra ID-based signing enables revocation, and the stored access policy enforces and centralizes the expiry constraint. Account and service SAS tokens lack identity binding and per-user revocation.

Answer

Enable anonymous public read access on the container and share the blob URLs.

Answer

Generate an account SAS with a 24-hour expiry and distribute it to external partners.

Answer

Configure a service SAS tied to the storage account key with a 24-hour lifetime.

Question 3

A software company is designing a multi-tenant SaaS application on Azure. The application stores tenant data in Azure SQL Database and Azure Blob Storage. The security architecture must ensure that one tenant cannot access another tenant's data even if the application has a bug, and that the data encryption keys for each tenant are isolated. You need to recommend controls that meet these requirements. (Choose two.)

Accepted Answer

Implement row-level security in Azure SQL Database with a tenant ID predicate and use separate customer-managed keys per tenant for TDE.. The two requirements are defense-in-depth tenant isolation at the data layer and per-tenant cryptographic key isolation. Row-level security with a tenant predicate plus per-tenant customer-managed TDE keys addresses the database side, while separate containers with user delegation SAS tokens addresses blob storage. Shared keys, Microsoft-managed keys, and application-only filtering all fail the threat model where the application itself may misbehave.

Answer

Enable Azure Storage service-side encryption with Microsoft-managed keys and tag blobs with the tenant ID.

Answer

Configure a single Azure Key Vault for all tenants and share the same customer-managed key across databases.

Answer

Use a shared storage account with a single account key and rely on application-level filtering for tenant separation.

Question 4

Your organization is deploying a new line-of-business application on Azure App Service. The app must authenticate users from Microsoft Entra ID and also access a downstream API that requires a client secret. You need to recommend the most secure method for managing the client secret. What should you use?

Accepted Answer

Store the secret in Azure Key Vault and use a Key Vault reference in App Service.. Storing the client secret in Azure Key Vault and referencing it from App Service via a Key Vault reference is the most secure method. Key Vault provides centralized secret management, access control via Entra ID, auditing, rotation capabilities, and hardware-backed protection (HSM) for keys. App Service can resolve Key Vault references at runtime using its managed identity, so the secret never appears in application settings or code.

Answer

Store the secret in the Azure AD app registration manifest.

Answer

Store the secret in an App Service application setting.

Answer

Store the secret in the application code as a constant.

Question 5

Your organization stores sensitive customer data in Azure Blob Storage. You need to implement data classification and labeling using Microsoft Purview. Which resource should you use to automatically scan and classify the data?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map is the correct choice because it is the foundational service that performs automated scanning, data discovery, and classification of data sources such as Azure Blob Storage, populating the catalog with sensitivity labels and classifications. It uses scan rule sets and classification rules to detect sensitive data types across registered sources. Azure Policy is a governance service for enforcing resource compliance, not for scanning and classifying data content. Microsoft Purview Information Protection applies sensitivity labels to files and emails but does not itself scan and classify data at rest in Blob Storage. Microsoft Purview Data Loss Prevention enforces policies to prevent data exfiltration, not to discover and classify stored data.

Answer

Azure Policy

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Loss Prevention

Question 6

Your organization uses Microsoft Purview Information Protection to label and protect sensitive emails and documents. You need to ensure that when a user applies a 'Highly Confidential' label, the content is automatically encrypted and a watermark is added. Which configuration should you use?

Accepted Answer

Configure a sensitivity label with encryption and watermark settings.. Sensitivity labels in Microsoft Purview Information Protection can be configured with encryption and content marking (watermark) settings, which are applied automatically when users apply the label. Option A is incorrect: the Azure Information Protection scanner discovers and labels existing files but does not configure label settings; the label itself must be defined. Option B is incorrect: a DLP policy can block sharing but cannot add watermarks or encrypt content on its own. Option D is incorrect: Microsoft 365 Message Encryption provides encryption for email transport but does not apply watermarks or enforce labels.

Answer

Use Azure Information Protection scanner to apply labels automatically.

Answer

Create a DLP policy that blocks sharing of highly confidential content.

Answer

Enable Microsoft 365 Message Encryption for all emails.

Question 7

Your organization is planning to use Microsoft Sentinel for security information and event management (SIEM). You need to ingest security logs from on-premises Active Directory. What should you deploy?

Accepted Answer

Azure Monitor Agent. The correct option is D, Azure Monitor Agent (AMA). AMA is the current, supported agent for collecting data into Log Analytics workspaces, which back Microsoft Sentinel, and it supports Data Collection Rules (DCRs) to ingest Windows security events from on-premises Active Directory domain controllers via the Azure Arc-enabled servers or the AMA extension. The Microsoft Monitoring Agent (A) and the Log Analytics agent (B) are legacy agents that are deprecated for Sentinel data collection and are being replaced by AMA. The Microsoft Defender for Cloud agent (C) is not a standalone log-ingestion agent for Sentinel; Defender for Cloud uses the Log Analytics/AMA agents for data collection, so it does not fit the requirement directly.

Answer

Microsoft Monitoring Agent (MMA)

Answer

Log Analytics agent

Answer

Microsoft Defender for Cloud agent

Question 8

Your organization uses Azure Data Lake Storage Gen2 for big data analytics. You need to secure access to the data using Azure RBAC and ACLs. Which two methods can you use to authorize access? (Choose two.)

Accepted Answer

Assign Azure RBAC roles such as Storage Blob Data Contributor to security principals.. Option B is correct because Azure Data Lake Storage Gen2 supports Azure RBAC role assignments, such as Storage Blob Data Contributor, Storage Blob Data Reader, and Storage Blob Data Owner, to authorize security principals (users, groups, service principals, managed identities) at the container or account scope. Option C is correct because ADLS Gen2 implements a POSIX-like ACL model at the directory and file level, allowing fine-grained read, write, and execute permissions for named users and groups in addition to RBAC. Option A is not a valid authorization method here; IP firewall rules are network-level access restrictions, not an authorization mechanism for data access. Option D is not itself an authorization method—managed identities are an identity type that must still be granted access via RBAC or ACLs. Option E is not the intended answer because SAS tokens are a delegation mechanism primarily associated with Blob Storage and are not the standard authorization approach for ADLS Gen2 hierarchical namespace access via RBAC and ACLs.

Answer

Configure IP firewall rules to restrict access.

Answer

Use managed identities for Azure resources.

Answer

Generate shared access signatures (SAS) for delegated access.

Question 9

Refer to the exhibit. You are reviewing an Azure Policy definition that uses a 'modify' effect. The policy is intended to automatically enable transparent data encryption (TDE) on Azure SQL databases after they are created. Which condition must be met for the modify effect to work?

Accepted Answer

A managed identity must be associated with the policy assignment and have permissions to modify TDE.. The correct answer is B: a managed identity must be associated with the policy assignment and have permissions to modify TDE. Azure Policy's modify effect performs remediation-style changes to resources, so the assignment needs a system-assigned or user-assigned managed identity with the required RBAC permissions (such as SQL DB Contributor or a custom role granting Microsoft.Sql/servers/databases/transparentDataEncryption/write) to actually enable TDE on the database. Option A is incorrect because modify works at any assignment scope (management group, subscription, resource group) as long as the identity and permissions are configured. Option C is incorrect because modify can act on existing resources during evaluation/remediation, not only newly created ones. Option D is incorrect because TDE enablement via modify is not limited to the General Purpose service tier.

Answer

The policy must be assigned at the management group scope.

Answer

The database must be newly created.

Answer

The SQL database must be using the General Purpose service tier.

Question 10

Refer to the exhibit. You are analyzing sign-in failures in Microsoft Sentinel using a KQL query. What does this query identify?

Accepted Answer

Accounts that had more than 10 failed logon attempts in the last 7 days.. The correct answer is C: Accounts that had more than 10 failed logon attempts in the last 7 days. This is because the KQL query filters SigninLogs for failed sign-in results (e.g., ResultType != 0 or ResultType == 50126) and summarizes the count by user over a 7-day window, returning accounts whose failure count exceeds 10. Option A is wrong because account lockout is a specific event/status (e.g., ResultType 50053) and the query counts failures rather than lockout events. Option B is wrong because the query aggregates by account, not by computer or source IP address. Option D is wrong because the query targets failed logons, not successful sign-ins.

Answer

Accounts that have been locked out due to multiple failures.

Answer

Computers with more than 10 login attempts from the same IP address.

Answer

Accounts that successfully logged in more than 10 times.

Question 11

Your organization uses Microsoft Defender for Cloud to protect Azure resources. You need to ensure that only authorized applications can access Azure Key Vault secrets. The solution must use managed identities and least privilege. What should you configure?

Accepted Answer

Assign a system-assigned managed identity to the application and grant it Key Vault Secrets User role. Option B is correct because assigning a system-assigned managed identity to the application and granting it the Key Vault Secrets User role provides an Microsoft Entra ID-backed identity that can be authorized via RBAC to read secrets, eliminating stored credentials and enforcing least privilege. The Key Vault Secrets User role grants only read access to secret contents, which matches the requirement that only authorized applications access secrets. Option A is wrong because SAS tokens are not the managed identity mechanism for Key Vault and storing a token in an environment variable introduces a shared secret. Option C is wrong because restricting inbound IP addresses controls network reachability, not application identity or least-privilege authorization. Option D is wrong because client certificate authentication does not use managed identities and requires certificate lifecycle management rather than Azure RBAC.

Answer

Use a shared access signature (SAS) token stored in an environment variable

Answer

Enable public network access on Key Vault and restrict inbound IP addresses

Answer

Install a client certificate on the application server and use it to authenticate to Key Vault

Question 12

You are designing a data classification strategy for Microsoft Purview. The compliance team requires that documents containing personally identifiable information (PII) like credit card numbers are automatically labeled and encrypted when stored in Microsoft SharePoint Online. The solution must use built-in sensitive information types. What should you include in the design?

Accepted Answer

Create a sensitivity label with auto-labeling for credit card numbers and enable encryption. Option A is correct because Microsoft Purview sensitivity labels support auto-labeling policies that can use built-in sensitive information types (SITs) such as Credit Card Number, and the label itself can enforce encryption via the label's encryption settings when applied to documents in SharePoint Online. This directly satisfies the requirement to automatically label and encrypt PII-containing documents using built-in SITs. Option B is incorrect because retention labels govern retention/deletion, not encryption, and DLP policies do not apply retention labels. Option C is incorrect because trainable classifiers are for custom content patterns, not built-in PII SITs like credit card numbers. Option D is incorrect because manual labeling does not meet the automatic labeling requirement.

Answer

Create a retention label and apply it automatically via a data loss prevention (DLP) policy

Answer

Use a trainable classifier to detect PII and apply a sensitivity label

Answer

Configure a manual sensitivity label policy for users to apply

Question 13

You are designing a secure DevOps pipeline using GitHub Actions and Azure. The security team requires that all container images pushed to Azure Container Registry (ACR) are scanned for vulnerabilities before deployment. If critical vulnerabilities are found, the pipeline must fail. What should you integrate into the pipeline?

Accepted Answer

Integrate Microsoft Defender for Cloud with Azure Container Registry scanning and configure a GitHub Actions step to check scan results. Option B is correct because Microsoft Defender for Cloud's container registry scanning (Defender for Containers) integrates natively with ACR to scan images on push, and a GitHub Actions step can query the scan results via the Azure CLI/REST API and fail the pipeline when critical vulnerabilities are detected. This directly satisfies the requirement to block deployment when critical findings exist. Option A does not fit because Azure Policy enforces governance on deployed resources and cannot fail a GitHub Actions build step based on scan results. Option C is wrong because Azure Bastion is a managed jump-host service for RDP/SSH access, not an image scanner. Option D is wrong because Azure Security Center is the legacy name for Defender for Cloud and, by itself, does not provide the pipeline-failing GitHub Actions integration described in B.

Answer

Configure Azure Policy to require image scanning before deployment

Answer

Deploy Azure Bastion to scan images during build

Answer

Use Azure Security Center (legacy) to scan images on push

Question 14

Your company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. You need to prevent users from sharing credit card numbers via email in Outlook on the web. The policy should notify users when they try to send such data and allow them to override with a business justification. What should you configure?

Accepted Answer

Create a DLP policy with the action 'Block with override' and enable 'Business justification'. The correct option is B: create a DLP policy with the action 'Block with override' and enable 'Business justification'. This is the only configuration that both prevents users from sending credit card numbers in Outlook on the web and lets them override the block by supplying a business justification, which is exactly what the scenario requires. Option A ('Audit only') merely logs activity without stopping the email, so it does not prevent sharing. Option C (encrypting emails) addresses confidentiality but does not block or notify the sender with an override path. Option D ('Block') stops the email but provides no override mechanism, so users cannot proceed with a justification.

Answer

Create a DLP policy with the action 'Audit only' for credit card numbers

Answer

Create a DLP policy that encrypts emails containing credit card numbers

Answer

Create a DLP policy with the action 'Block' for credit card numbers

Question 15

You are designing a solution to protect Azure SQL Database from SQL injection attacks. The solution must use a web application firewall (WAF) and also ensure that queries from the application are parameterized. Which two components should you include? (Choose two. Each correct answer presents part of the solution.)

Accepted Answer

Azure Application Gateway with WAF. Option C is correct because Azure Application Gateway with WAF provides a web application firewall that can inspect incoming HTTP/HTTPS traffic and block common SQL injection patterns using OWASP rule sets before requests reach the application or database. Option D is correct because parameterized queries in the application code ensure user input is treated as data rather than executable SQL, which is the primary defense against SQL injection at the application layer. Together, these two components satisfy both stated requirements: a WAF and parameterized queries. Option A, Azure SQL Database firewall rules, only controls which IP addresses or Azure services can connect to the database and does not inspect query content for injection attacks. Option B, Transparent Data Encryption (TDE), encrypts data at rest and does not prevent SQL injection or filter malicious queries.

Answer

Azure SQL Database firewall rules

Answer

Transparent Data Encryption (TDE)