SC-100 Design security solutions for applications and data Practice Test 8 — 15 Questions

Question 1

Your company is developing a web application that stores sensitive customer data in Azure SQL Database. The data must be encrypted at rest and in transit. Additionally, you need to ensure that only the application can access the database, not individual administrators. Which two technologies should you implement? (Choose two.)

Accepted Answer

Azure Key Vault. Option A is correct: Transparent Data Encryption (TDE) encrypts data at rest. Option C is correct: Always Encrypted protects data in transit and during processing by keeping encryption keys client-side, preventing administrators from seeing plaintext. Option B is wrong: Azure Information Protection is for labeling and classification, not database encryption. Option D is wrong: Dynamic Data Masking obfuscates data but does not encrypt it. Option E is wrong: Azure Key Vault is used to store keys but is not the encryption mechanism itself.

Answer

Azure Information Protection

Answer

Dynamic Data Masking

Answer

Always Encrypted

Answer

Transparent Data Encryption (TDE)

Question 2

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft 365. You need to ensure that when a user attempts to share a document containing credit card numbers externally, the action is blocked and the user is shown a policy tip. Which DLP rule configuration should you use?

Accepted Answer

Block the action with a policy tip and allow override. Option B is correct: Block with override and policy tip allows the block and shows the tip, while still allowing user override if they provide justification. Option A is wrong: Block without override is too restrictive and does not show a policy tip. Option C is wrong: Audit only does not block the action. Option D is wrong: Block with notification sends an email but not a policy tip.

Answer

Block the action and send an incident report in email

Answer

Audit the action only

Answer

Block the action without allowing override

Question 3

You are designing a solution to securely store and manage secrets for a cloud-native application deployed on Azure Kubernetes Service (AKS). The application needs to retrieve database connection strings and API keys at runtime without hardcoding them. The solution must minimize administrative overhead and integrate with Azure Active Directory (now Microsoft Entra ID) for access control. Which service should you use?

Accepted Answer

Azure Key Vault with managed identities. Option C is correct: Azure Key Vault with managed identities for AKS allows secure secret retrieval without storing credentials in code or configuration, integrates with Entra ID, and minimizes overhead. Option A is wrong: Kubernetes Secrets are not encrypted by default and require additional configuration. Option B is wrong: Azure App Configuration can store configuration but is not optimized for secrets. Option D is wrong: HashiCorp Vault adds complexity and is not a native Azure service.

Answer

Kubernetes Secrets

Answer

HashiCorp Vault on AKS

Answer

Azure App Configuration

Question 4

Your organization is implementing Microsoft Defender for Cloud Apps to protect against malicious OAuth app permissions. Users have been granting permissions to third-party apps that request excessive scopes. What should you configure to automatically revoke such permissions?

Accepted Answer

OAuth app policies in Defender for Cloud Apps. Option B is correct: OAuth app policies in Defender for Cloud Apps allow you to set policies to automatically revoke permissions for apps that meet certain criteria. Option A is wrong: Conditional Access policies can block access but do not revoke app permissions. Option C is wrong: Azure AD app permissions management is part of Entra ID, but automatic revocation is done via Defender for Cloud Apps. Option D is wrong: Intune is for device management, not app permissions.

Answer

Microsoft Intune app protection policies

Answer

Conditional Access policies

Answer

Azure AD app permissions management

Question 5

You are designing a data security solution for a Microsoft 365 tenant that contains highly confidential files. You need to ensure that these files are encrypted and can only be accessed by authorized users, even if the files are downloaded and stored on a personal device. Which technology should you use?

Accepted Answer

Microsoft Purview Information Protection with encryption and usage rights. Option D is correct: Microsoft Purview Information Protection with encryption and usage rights restricts access even after download, because the protection travels with the file. Option A is wrong: BitLocker encrypts the device, not individual files. Option B is wrong: Office 365 Message Encryption is for email, not files. Option C is wrong: Azure Information Protection (now part of Purview) is the correct technology, but the more specific answer is Purview Information Protection.

Answer

Office 365 Message Encryption

Answer

BitLocker Drive Encryption

Answer

Azure Information Protection

Question 6

Your company runs a critical application on Azure VMs. You need to ensure that only authorized applications can run on the VMs to prevent malware. Which Azure security feature should you enable?

Accepted Answer

Windows Defender Application Control (WDAC). Option B is correct: Application Control (Windows Defender Application Control) allows you to specify which applications are allowed to run. Option A is wrong: Antimalware detects and removes malware but does not control which apps can run. Option C is wrong: Just-In-Time VM access controls network access, not application execution. Option D is wrong: Azure Security Center (now Defender for Cloud) provides recommendations but not direct app control.

Answer

Azure Security Center adaptive application controls

Answer

Just-In-Time VM access

Answer

Azure Antimalware

Question 7

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to create an analytics rule that detects when a user account is created outside of business hours from an unusual IP address. Which type of rule should you use?

Accepted Answer

Scheduled query rule. Option C is correct: Scheduled query rules run at regular intervals to detect suspicious activity based on KQL queries. Option A is wrong: Fusion is for multistage attacks. Option B is wrong: ML Behavior Analytics uses machine learning, not custom queries. Option D is wrong: Anomaly rules are for detecting anomalies, not specific conditions.

Answer

Anomaly rule

Answer

ML Behavior Analytics rule

Answer

Fusion rule

Question 8

You are designing a solution to protect sensitive data in Azure Blob Storage. The data must be encrypted at rest using customer-managed keys (CMK) stored in Azure Key Vault. Additionally, you need to ensure that only specific virtual networks can access the storage account, and all access must be logged. Which three configurations should you implement? (Choose three.)

Accepted Answer

Enable Azure Storage logging for read and write requests. Options A, C, and D are correct. Option A provides CMK encryption. Option C restricts network access. Option D enables logging. Option B is wrong: Azure Files is different; Blob Storage encryption is configured at the account level. Option E is wrong: Soft delete is for data recovery, not encryption or access control.

Answer

Enable Azure Files encryption at rest

Answer

Enable soft delete for blobs

Question 9

Your company is developing a mobile application that uses Microsoft Authenticator to sign in users. The app needs to call a web API that is protected by Microsoft Entra ID. You need to ensure that the app uses the OAuth 2.0 authorization code flow with PKCE. Which Microsoft authentication library should you recommend?

Accepted Answer

Microsoft Authentication Library (MSAL). Option D is correct: Microsoft Authentication Library (MSAL) supports the authorization code flow with PKCE for mobile apps. Option A is wrong: Active Directory Authentication Library (ADAL) is deprecated. Option B is wrong: Azure AD Graph API is not an authentication library. Option C is wrong: Microsoft Graph API is for accessing resources, not authentication.

Answer

Microsoft Graph API

Answer

Active Directory Authentication Library (ADAL)

Answer

Azure AD Graph API

Question 10

Your organization is using Microsoft Defender for Cloud to assess the security posture of your Azure resources. You need to ensure that all storage accounts have secure transfer required enabled. Which Defender for Cloud feature should you use?

Accepted Answer

Security policies and initiatives. Option A is correct: Security policies and initiatives allow you to define and enforce compliance requirements. Option B is wrong: Just-In-Time VM access is for network access. Option C is wrong: Adaptive network hardening is for NSGs. Option D is wrong: File integrity monitoring is for critical files.

Answer

File integrity monitoring

Answer

Adaptive network hardening

Answer

Just-In-Time VM access

Question 11

You are designing a data classification strategy for a Microsoft 365 tenant. You need to automatically classify documents that contain personally identifiable information (PII) and apply a retention label. Which Microsoft Purview feature should you use?

Accepted Answer

Auto-labeling policies. Option C is correct: Auto-labeling policies in Purview can automatically classify and apply labels based on sensitive information types. Option A is wrong: Trainable classifiers require training and are for more complex classification, not automatic for PII. Option B is wrong: Manual labeling is not automatic. Option D is wrong: DLP policies are for enforcement, not automatic labeling.

Answer

Trainable classifiers

Answer

Manual labeling

Answer

Data Loss Prevention (DLP) policies

Question 12

Your company uses Microsoft Azure to host a critical application that processes credit card payments. The application must comply with PCI DSS. You need to ensure that all access to cardholder data is logged and monitored, and that any unauthorized access attempts trigger an alert. Which combination of services should you use?

Accepted Answer

Azure Monitor and Microsoft Sentinel. Option B is correct: Azure Monitor logs access, and Microsoft Sentinel provides alerting. Option A is wrong: Defender for Cloud provides security posture but not logging. Option C is wrong: Azure Policy enforces compliance but does not log or alert. Option D is wrong: Key Vault is for secrets, not logging.

Answer

Azure Policy and Microsoft Defender for Cloud Apps

Answer

Azure Policy and Microsoft Defender for Cloud

Answer

Azure Key Vault and Microsoft Defender for Cloud

Question 13

A company is designing a secure API for a customer-facing application that will handle sensitive personal data. They need to ensure that only authorized client applications can call the API and that the identity of the end-user is verified. Which of the following should they implement?

Accepted Answer

OAuth 2.0 with client credentials and OpenID Connect. Option D is correct because OAuth 2.0 with client credentials and OpenID Connect provides both client authentication and user authentication. Option A is wrong because API keys only authenticate the client, not the user. Option B is wrong because Basic Auth transmits credentials in plaintext. Option C is wrong because JWT tokens are a format, not an authentication protocol.

Answer

HTTP Basic Authentication

Answer

JWT bearer tokens

Answer

API keys

Question 14

A financial services company is deploying a new application on Azure Kubernetes Service (AKS). The application must meet PCI DSS compliance requirements, which mandate encryption of data at rest and in transit, as well as network segmentation. The application will use Azure SQL Database. What is the MOST secure approach to meet these requirements?

Accepted Answer

Use Azure Policy to enforce encryption and network policies in AKS, and enable TDE and Always Encrypted for Azure SQL Database.. Option C is correct because it combines Azure Policy to enforce encryption, network policies for segmentation, and Azure SQL Database with TDE and Always Encrypted for data protection. Option A is wrong because service endpoints do not encrypt in-transit traffic and do not provide segmentation. Option B is wrong because Azure Firewall is a perimeter firewall, not granular network policy within AKS. Option D is wrong because App Service Environment is not used for AKS.

Answer

Deploy the application in an Azure App Service Environment (ASE) with a private endpoint and enable SQL Server encryption.

Answer

Use Azure Service Endpoints for the AKS cluster and enable Transparent Data Encryption (TDE) on Azure SQL Database.

Answer

Deploy Azure Firewall in front of the AKS cluster and enable SSL/TLS termination at the firewall for all incoming traffic.

Question 15

You are designing a solution for a healthcare organization that needs to share patient health information (PHI) with a partner organization. The partner must be able to query the data but should not be able to modify it. Both organizations use Microsoft Entra ID. What should you use?

Accepted Answer

Microsoft Entra entitlement management with an access package that grants read-only access to a SharePoint Online site.. Option A is correct because Microsoft Entra entitlement management allows you to create access packages that grant external users read-only access to SharePoint Online or other resources. Option B is wrong because Azure AD B2C is for customer identity. Option C is wrong because Microsoft Purview Information Protection is for classification and labeling, not for external sharing with read-only access. Option D is wrong because Azure DevOps is for development collaboration.

Answer

Azure Active Directory B2C (now part of Entra) to allow the partner to authenticate and access data via a custom API.

Answer

Microsoft Purview Information Protection to label the data and allow the partner to decrypt it.

Answer

Azure DevOps for sharing the data in a repository with read-only permissions.