SC-100 Design security solutions for applications and data Practice Test 7 — 15 Questions

Question 1

Your organization is adopting Microsoft Copilot for Microsoft 365. You need to ensure that Copilot respects the existing sensitivity labels when processing data. What should you configure?

Accepted Answer

Configure sensitivity labels in Microsoft Purview Information Protection.. Microsoft Purview Information Protection sensitivity labels are respected by Microsoft Copilot for Microsoft 365, ensuring that Copilot honors the sensitivity of data when processing it. Option A is wrong because DLP policies focus on preventing data loss, not on sensitivity labeling. Option C is wrong because Azure Information Protection is a legacy solution; Microsoft Purview Information Protection is the current recommended approach. Option D is wrong because retention labels are for managing data retention and disposition, not sensitivity.

Answer

Create Data Loss Prevention (DLP) policies.

Answer

Use Azure Information Protection.

Answer

Apply retention labels to documents.

Question 2

You are designing a solution for an Azure SQL Database that stores sensitive financial data. The compliance team requires that all queries are audited and that access to sensitive columns is restricted for certain users. What should you implement?

Accepted Answer

Use Always Encrypted for sensitive columns and enable Azure SQL Auditing.. Using Always Encrypted protects sensitive columns at rest and in transit, and auditing via Azure SQL Auditing meets compliance. Option A is wrong because TDE encrypts the entire database, not columns. Option B is wrong because Dynamic Data Masking masks data but does not restrict access. Option C is wrong because Row-Level Security restricts rows, not columns.

Answer

Enable Transparent Data Encryption (TDE) and SQL Server Audit.

Answer

Use Dynamic Data Masking and SQL Server Audit.

Answer

Implement Row-Level Security (RLS) and enable audit.

Question 3

You need to design a secure solution for a web application that authenticates users via Microsoft Entra ID and calls a downstream API. Which TWO should you implement to secure the application? (Choose TWO.)

Accepted Answer

Use the OAuth 2.0 authorization code flow with PKCE.. The correct answers are A and B. Option A: The OAuth 2.0 authorization code flow with PKCE is the recommended flow for web applications that need to authenticate users and obtain delegated access to downstream APIs. Option B: Storing application secrets (such as client secrets) in Azure Key Vault is a security best practice that ensures secrets are securely managed and rotated. Option C is incorrect because storing secrets in app configuration files is insecure and exposes them to potential theft. Option D is incorrect because the client credentials flow is intended for server-to-server scenarios, not for user authentication. Option E is incorrect because shared access signatures (SAS) are used for granting limited access to Azure Storage resources, not for API authentication.

Answer

Store application secrets in app configuration files.

Answer

Use the OAuth 2.0 client credentials flow.

Answer

Use shared access signatures (SAS) for API authentication.

Question 4

Your organization uses Microsoft Purview to protect sensitive data. You need to implement a solution that automatically detects and protects personally identifiable information (PII) in Microsoft 365. Which THREE should be part of your solution? (Choose THREE.)

Accepted Answer

Microsoft Purview Information Protection scanner. The correct answers are C, D, and E. Microsoft Purview Information Protection scanner discovers and classifies sensitive data, including PII, on on-premises file shares. Microsoft Purview Data Loss Prevention (DLP) policies detect and protect PII in transit and at rest within Microsoft 365, such as in emails or documents. Sensitivity labels in Microsoft Purview Information Protection allow you to classify data and enforce protection actions like encryption or restrictions. Option A is incorrect because Azure Policy is used to enforce organizational standards and assess compliance for Azure resources, not for data scanning in Microsoft 365. Option B is incorrect as Microsoft Defender for Cloud provides cloud security posture management and threat protection for workloads, not data classification or protection for Microsoft 365 content.

Answer

Azure Policy

Answer

Microsoft Defender for Cloud

Question 5

You are designing an API management solution using Azure API Management. Which TWO should you implement to protect the API from unauthorized access? (Choose TWO.)

Accepted Answer

Implement OAuth 2.0 authorization with Microsoft Entra ID.. The correct answers are A and E. OAuth 2.0 with Microsoft Entra ID (A) provides delegated authorization, allowing API Management to validate tokens and restrict access based on permissions. Subscription keys (E) offer a simple authentication mechanism by requiring a unique key in each API call. Option B (client certificates) is for mutual TLS authentication, which is not a primary method for typical API access. Option C (CORS) controls cross-origin requests but does not authenticate callers. Option D (IP address restriction) limits access by network location but is not an authentication method.

Answer

Use client certificates for authentication.

Answer

Enable Cross-Origin Resource Sharing (CORS).

Answer

Restrict access by IP address only.

Question 6

Refer to the exhibit. You are deploying an Azure Storage container for storing compliance records. The ARM template snippet above configures the container. Which statement accurately describes the configuration?

Accepted Answer

Blobs cannot be modified or deleted for 365 days after creation.. The ARM template sets publicAccess to 'None', so no anonymous access; sets isVersioningEnabled to true, so versioning is enabled; sets allowProtectedAppendWrites to false, so protected append writes are not allowed; and enables an immutability policy with a retention period of 365 days, meaning blobs cannot be modified or deleted for 365 days after creation. Therefore, Option A is wrong because allowProtectedAppendWrites is false; Option B is wrong because isVersioningEnabled is true; Option C is wrong because publicAccess is 'None'.

Answer

The container allows protected append writes.

Answer

Blob versioning is disabled for the container.

Answer

The container allows anonymous read access.

Question 7

Refer to the exhibit. You are auditing an Azure subscription. The Azure Policy assignment above is targeting a resource group. The policy definition ID corresponds to a built-in policy that audits if SQL databases have transparent data encryption (TDE) enabled. What is the effect of this policy assignment?

Accepted Answer

The policy audits SQL databases for TDE and marks non-compliant resources.. The policy definition ID corresponds to a built-in policy that audits if SQL databases have TDE enabled. Since it is an audit policy, it evaluates resources and marks them as compliant or non-compliant, but it does not automatically enable TDE or enforce remediation. Option A is incorrect because the policy does not automatically enable TDE; it only audits. Option B is incorrect because while the policy effect is audit, it still produces compliance states (non-compliant marking), so it is not 'only reported' without any visible outcome. Option C is incorrect because the policy is scoped to a resource group, not a management group. Option D correctly describes the audit effect: it audits and marks non-compliant resources.

Answer

The policy automatically enables TDE on non-compliant SQL databases.

Answer

The policy is only reported as audit, not enforced.

Answer

The policy applies to all resources in the management group.

Question 8

Refer to the exhibit. You are investigating a security incident in Microsoft Sentinel. The KQL query above is used to identify potential brute-force attacks. What does the query return?

Accepted Answer

A list of user accounts and computers where the account has more than 5 failed logins in the last 24 hours.. The query filters SecurityEvent for failed logins in the last 24 hours, groups by Account and Computer, counts them, and filters for counts > 5. It returns a list of user accounts and computers where the account has more than 5 failed logins in the last 24 hours. Option A is incorrect because the query returns both Account and Computer, not just a list of computers. Option B is incorrect because the query groups by Account and Computer, so it does not aggregate across all computers; it returns failed logins per account per computer. Option D is incorrect because the query filters for failed logins, not successful logins.

Answer

A list of computers with more than 5 failed logins from any account.

Answer

A list of user accounts with more than 5 failed logins across all computers.

Answer

A list of user accounts with more than 5 successful logins in the last 24 hours.

Question 9

Your company is developing a web application that stores sensitive customer data in Azure SQL Database. The data must be encrypted at rest and in transit. Additionally, you need to ensure that only the application can access the database, not individual administrators. Which two technologies should you implement? (Choose two.)

Accepted Answer

Azure Key Vault. Azure Key Vault securely stores encryption keys used by Always Encrypted, enabling client-side key management that prevents administrators from accessing plaintext keys. Option D is correct: Always Encrypted encrypts sensitive data both at rest and in transit, and because encryption keys are stored client-side, administrators cannot view plaintext data, fulfilling the requirement that only the application can access the database. Option B is wrong: Azure Information Protection is for data classification and labeling, not database encryption. Option C is wrong: Dynamic Data Masking only obfuscates data in query results, does not provide encryption or access control. Option E is wrong: Transparent Data Encryption (TDE) encrypts data at rest but not in transit, and it does not prevent administrators from accessing plaintext data because SQL Server manages the keys.

Answer

Azure Information Protection

Answer

Dynamic Data Masking

Answer

Transparent Data Encryption (TDE)

Question 10

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft 365. You need to ensure that when a user attempts to share a document containing credit card numbers externally, the action is blocked and the user is shown a policy tip. Which DLP rule configuration should you use?

Accepted Answer

Block the action with a policy tip and allow override. Block the action with a policy tip and allow override. This configuration blocks the sharing action and displays a policy tip to the user, while still allowing the user to override the block if they provide a business justification. Option B is incorrect because sending an incident report via email is a separate action that can be combined with a block, but it does not show a policy tip to the user. Option C is incorrect because audit-only does not block the action. Option D is incorrect because blocking without allowing an override is too restrictive and does not show the policy tip.

Answer

Block the action and send an incident report in email

Answer

Audit the action only

Answer

Block the action without allowing override

Question 11

You are designing a solution to securely store and manage secrets for a cloud-native application deployed on Azure Kubernetes Service (AKS). The application needs to retrieve database connection strings and API keys at runtime without hardcoding them. The solution must minimize administrative overhead and integrate with Azure Active Directory (now Microsoft Entra ID) for access control. Which service should you use?

Accepted Answer

Azure Key Vault with managed identities. Azure Key Vault with managed identities for AKS allows secure secret retrieval without storing credentials in code or configuration, integrates with Entra ID, and minimizes overhead. Option A is wrong: Kubernetes Secrets are not encrypted by default and require additional configuration. Option B is wrong: HashiCorp Vault adds complexity and is not a native Azure service. Option D is wrong: Azure App Configuration can store configuration but is not optimized for secrets.

Answer

Kubernetes Secrets

Answer

HashiCorp Vault on AKS

Answer

Azure App Configuration

Question 12

Your organization is implementing Microsoft Defender for Cloud Apps to protect against malicious OAuth app permissions. Users have been granting permissions to third-party apps that request excessive scopes. What should you configure to automatically revoke such permissions?

Accepted Answer

OAuth app policies in Defender for Cloud Apps. OAuth app policies in Defender for Cloud Apps allow you to set policies to automatically revoke permissions for apps that meet certain criteria, such as excessive scopes or high risk scores. Option B is wrong: Intune app protection policies manage data protection on devices but do not revoke OAuth app permissions. Option C is wrong: Conditional Access policies can block access or require MFA but do not automatically revoke app permissions. Option D is wrong: Azure AD app permissions management (now part of Microsoft Entra) provides visibility and manual remediation, but automatic revocation is via Defender for Cloud Apps.

Answer

Microsoft Intune app protection policies

Answer

Conditional Access policies

Answer

Azure AD app permissions management

Question 13

You are designing a data security solution for a Microsoft 365 tenant that contains highly confidential files. You need to ensure that these files are encrypted and can only be accessed by authorized users, even if the files are downloaded and stored on a personal device. Which technology should you use?

Accepted Answer

Microsoft Purview Information Protection with encryption and usage rights. Microsoft Purview Information Protection with encryption and usage rights ensures that files remain protected even after download, because the protection travels with the file, restricting access to authorized users only. Option A (Office 365 Message Encryption) is incorrect because it applies only to email messages, not to files stored or shared. Option C (BitLocker Drive Encryption) is incorrect because it encrypts entire drives at the device level, not individual files, and does not control user access after the file is downloaded. Option D (Azure Information Protection) is a predecessor technology that has been integrated into Microsoft Purview Information Protection; however, the more specific and current answer is Microsoft Purview Information Protection, which encompasses the labeling and protection capabilities.

Answer

Office 365 Message Encryption

Answer

BitLocker Drive Encryption

Answer

Azure Information Protection

Question 14

Your company runs a critical application on Azure VMs. You need to ensure that only authorized applications can run on the VMs to prevent malware. Which Azure security feature should you enable?

Accepted Answer

Windows Defender Application Control (WDAC). Windows Defender Application Control (WDAC) is correct because it enforces a whitelist of allowed applications, preventing unauthorized executables from running. Option A (Azure Security Center adaptive application controls) is a policy recommendation feature that helps identify which applications are running, but it does not block execution by itself. Option B (Just-In-Time VM access) controls network access to management ports, not application execution. Option C (Azure Antimalware) is a signature-based malware detection tool that does not provide application control.

Answer

Azure Security Center adaptive application controls

Answer

Just-In-Time VM access

Answer

Azure Antimalware

Question 15

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to create an analytics rule that detects when a user account is created outside of business hours from an unusual IP address. Which type of rule should you use?

Accepted Answer

Scheduled query rule. Scheduled query rules run at regular intervals to detect suspicious activity based on custom KQL queries. This allows you to specify conditions like user account creation outside business hours from unusual IP addresses. Option A (Anomaly rule) uses machine learning to detect anomalies and cannot be customized with specific conditions. Option C (ML Behavior Analytics rule) uses machine learning models for behavioral analytics, not custom query logic. Option D (Fusion rule) correlates multiple alerts across different product types to detect multistage attacks, which is not needed here.

Answer

Anomaly rule

Answer

ML Behavior Analytics rule

Answer

Fusion rule