SC-100 Design security solutions for applications and data Practice Test 8 — 15 Questions

Question 1

You are designing a solution to protect sensitive data in Azure Blob Storage. The data must be encrypted at rest using customer-managed keys (CMK) stored in Azure Key Vault. Additionally, you need to ensure that only specific virtual networks can access the storage account, and all access must be logged. Which three configurations should you implement? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Azure Storage logging for read and write requests. Enables Azure Storage logging, which is required to log access to the storage account. Option B enables encryption with customer-managed keys stored in Azure Key Vault, meeting the encryption requirement. Option C configures a firewall and virtual network service endpoint, restricting access to only specific virtual networks. Options D and E are incorrect: D refers to Azure Files encryption, which is not applicable; E is soft delete for data recovery, not encryption or access control.

Answer

Enable Azure Files encryption at rest

Answer

Enable soft delete for blobs

Question 2

Your company is developing a mobile application that uses Microsoft Authenticator to sign in users. The app needs to call a web API that is protected by Microsoft Entra ID. You need to ensure that the app uses the OAuth 2.0 authorization code flow with PKCE. Which Microsoft authentication library should you recommend?

Accepted Answer

Microsoft Authentication Library (MSAL). (Microsoft Graph API) is incorrect because it is not an authentication library; it is a REST API for accessing Microsoft 365 data. Option C (Active Directory Authentication Library - ADAL) is incorrect because it is deprecated and does not support PKCE. Option D (Azure AD Graph API) is incorrect because it is deprecated and not an authentication library. Option B (Microsoft Authentication Library - MSAL) is correct because it is the recommended library for implementing the OAuth 2.0 authorization code flow with PKCE in mobile applications.

Answer

Microsoft Graph API

Answer

Active Directory Authentication Library (ADAL)

Answer

Azure AD Graph API

Question 3

Your organization is using Microsoft Defender for Cloud to assess the security posture of your Azure resources. You need to ensure that all storage accounts have secure transfer required enabled. Which Defender for Cloud feature should you use?

Accepted Answer

Security policies and initiatives. Security policies and initiatives allow you to define and enforce compliance requirements. Option B is wrong: File integrity monitoring monitors changes to critical files, not storage transfer settings. Option C is wrong: Adaptive network hardening adjusts NSG rules, not storage settings. Option D is wrong: Just-In-Time VM access controls network access to VMs, not storage.

Answer

File integrity monitoring

Answer

Adaptive network hardening

Answer

Just-In-Time VM access

Question 4

You are designing a data classification strategy for a Microsoft 365 tenant. You need to automatically classify documents that contain personally identifiable information (PII) and apply a retention label. Which Microsoft Purview feature should you use?

Accepted Answer

Auto-labeling policies. Auto-labeling policies in Microsoft Purview can automatically classify documents based on sensitive information types (such as PII) and apply retention labels without manual intervention. Option B is wrong: Trainable classifiers are used for pattern-based content that requires machine learning training, not for straightforward PII detection. Option C is wrong: Manual labeling requires users to apply labels manually, which is not automatic. Option D is wrong: Data Loss Prevention (DLP) policies are used to enforce protection actions (e.g., blocking or alerting) based on labels or sensitive info types, not for automatically applying labels.

Answer

Trainable classifiers

Answer

Manual labeling

Answer

Data Loss Prevention (DLP) policies

Question 5

Your company uses Microsoft Azure to host a critical application that processes credit card payments. The application must comply with PCI DSS. You need to ensure that all access to cardholder data is logged and monitored, and that any unauthorized access attempts trigger an alert. Which combination of services should you use?

Accepted Answer

Azure Monitor and Microsoft Sentinel. Azure Monitor collects logs and metrics from Azure resources, enabling logging of access to cardholder data. Microsoft Sentinel provides SIEM capabilities, including alerting on unauthorized access attempts. Option A is wrong: Microsoft Defender for Cloud Apps is a CASB, not focused on logging and alerting for Azure resources. Option B is wrong: Azure Policy is for compliance enforcement, not logging or alerting. Option C is wrong: Azure Key Vault manages secrets and keys, not logging access to cardholder data.

Answer

Azure Policy and Microsoft Defender for Cloud Apps

Answer

Azure Policy and Microsoft Defender for Cloud

Answer

Azure Key Vault and Microsoft Defender for Cloud

Question 6

You are designing a solution for a healthcare organization that needs to share patient health information (PHI) with a partner organization. The partner must be able to query the data but should not be able to modify it. Both organizations use Microsoft Entra ID. What should you use?

Accepted Answer

Microsoft Entra entitlement management with an access package that grants read-only access to a SharePoint Online site.. Microsoft Entra entitlement management allows you to create access packages that grant external users read-only access to SharePoint Online or other resources. Option A is wrong because Azure AD B2C is for customer identity, not for sharing data with partner organizations. Option C is wrong because Microsoft Purview Information Protection is for classification and labeling, not for external sharing with read-only access. Option D is wrong because Azure DevOps is for development collaboration, not for sharing sensitive data with read-only permissions.

Answer

Azure Active Directory B2C (now part of Entra) to allow the partner to authenticate and access data via a custom API.

Answer

Microsoft Purview Information Protection to label the data and allow the partner to decrypt it.

Answer

Azure DevOps for sharing the data in a repository with read-only permissions.

Question 7

Your organization is developing a new application that will use Azure Cosmos DB. The security team requires that all data be encrypted at rest and in transit, and that access to the database is limited to specific Azure services and IP addresses. The application will run on Azure VMs. Which three actions should you take? (Choose three.)

Accepted Answer

Configure Cosmos DB to require TLS for all client connections.. Forcing TLS ensures data in transit is encrypted. Option C is correct because using a private endpoint restricts network access to the private endpoint only, limiting exposure. Option D is correct because customer-managed keys provide additional control over encryption at rest. Option B is incorrect because Azure SQL Database is a different service and not relevant to securing Cosmos DB. Option E is incorrect because allowing all Azure services is too permissive and does not restrict access to specific services or IP addresses as required.

Answer

Use Azure SQL Database instead of Cosmos DB for better security features.

Answer

Configure the Cosmos DB firewall to allow access from all Azure services.

Question 8

Your organization is using Microsoft Defender for Cloud to secure applications running on Azure. You need to ensure that all Azure Storage accounts have secure transfer required enabled. What is the BEST way to enforce this?

Accepted Answer

Assign an Azure Policy initiative that includes the built-in policy 'Secure transfer to storage accounts should be enabled' with a 'Deny' effect.. The best because Azure Policy can enforce compliance at scale using the built-in policy 'Secure transfer to storage accounts should be enabled' with a 'Deny' effect, preventing non-compliant storage accounts from being created or updated. Option A is incorrect because Defender for Cloud recommendations are advisory only and do not automatically enforce the setting. Option B is deprecated; Azure Blueprints has been replaced by Azure Deployment Stacks and Azure Policy is the correct tool for enforcement. Option D is incorrect because RBAC roles control permissions, not configuration compliance.

Answer

Create a custom recommendation in Microsoft Defender for Cloud to alert when storage accounts do not have secure transfer required.

Answer

Use Azure Blueprints to apply the setting to all subscriptions.

Answer

Grant the 'Storage Account Contributor' role to a security group that will manually enable the setting.

Question 9

You are designing a solution for a multi-national corporation that uses Microsoft Purview to govern data across Azure SQL Database, Azure Data Lake Storage, and Microsoft 365. The data classification labels must be automatically applied based on sensitive data types such as credit card numbers and passport numbers. Which Microsoft Purview capability should you use?

Accepted Answer

Microsoft Purview Data Map with automatic classification. Microsoft Purview Data Map with automatic classification scanning can scan data sources (e.g., Azure SQL Database, Azure Data Lake Storage) and apply sensitivity labels based on built-in or custom sensitive data types such as credit card numbers and passport numbers. Option A is incorrect because Data Loss Prevention (DLP) policies are designed to prevent unauthorized data sharing, not to automatically classify data. Option B is incorrect because Audit logs user activities and does not perform classification. Option C is incorrect because Information Protection focuses on labeling and protection within Microsoft 365, but does not scan external data sources like Azure SQL or Data Lake.

Answer

Microsoft Purview Data Loss Prevention (DLP) policies

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Information Protection

Question 10

A company is building a new SaaS application that will be used by external customers. The application uses Azure API Management (APIM) to expose APIs. The security requirements include: (1) Only authenticated and authorized customers can call the APIs, (2) The API keys must be rotated automatically every 90 days, (3) The APIs must be protected against common web vulnerabilities. What should you implement?

Accepted Answer

Use OAuth 2.0 with Azure AD (Entra ID) for authentication, configure API key rotation in APIM policies, and enable Azure Web Application Firewall (WAF) in front of APIM.. It combines OAuth 2.0 with Azure AD (Entra ID) for authentication and authorization, automatic API key rotation via APIM policies (e.g., using a policy to set expiration and rotate keys), and Azure Web Application Firewall (WAF) in front of APIM to protect against common web vulnerabilities. Option A is incorrect because IP whitelisting is not a strong authentication method and manual rotation does not meet the automatic requirement. Option B is incorrect because client certificates require certificate management and do not automatically rotate API keys. Option D is incorrect because rate limiting does not provide authentication or vulnerability protection beyond rate control.

Answer

Use IP whitelisting in APIM to restrict access to known customer IPs and enable API key rotation manually every 90 days.

Answer

Require client certificates for authentication and configure APIM to automatically rotate the certificates.

Answer

Implement OAuth 2.0 with JWT tokens and use rate limiting to mitigate attacks.

Question 11

Your organization uses Microsoft 365 and wants to prevent users from sharing sensitive documents externally via email. The solution must be able to detect credit card numbers and automatically block the email. Which technology should you use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online. Microsoft Purview Data Loss Prevention (DLP) policies for Exchange Online can automatically detect sensitive information types like credit card numbers and block the email from being sent. Option A is wrong because Microsoft Purview Sensitivity labels with auto-classification are designed to classify and protect documents, but they do not natively block email transmission based on content. Option B is wrong because Microsoft Defender for Office 365 Safe Attachments focuses on protecting against malware and phishing, not on detecting and blocking sensitive data in email. Option D is wrong because Azure Information Protection (AIP) unified labeling client is primarily for applying classification labels, not for enforcing DLP rules to block emails.

Answer

Microsoft Purview Sensitivity labels with auto-classification

Answer

Microsoft Defender for Office 365 Safe Attachments

Answer

Azure Information Protection (AIP) unified labeling client

Question 12

You are designing a secure data sharing solution for a research organization that needs to share large datasets with external universities. The data must be encrypted at rest and in transit, and access must be time-limited. The solution should minimize administrative overhead. What should you use?

Accepted Answer

Azure Storage with shared access signatures (SAS) and Azure Key Vault. Azure Blob Storage with shared access signatures (SAS) allows time-limited access, encryption at rest (SSE), and encryption in transit (HTTPS/SSL). SAS tokens can be generated with expiry times, minimizing administrative overhead. Option A is wrong because SFTP adds complexity and requires additional user management; also, SFTP does not natively support time-limited access. Option B is wrong because snapshot-based sharing is periodic and not suitable for direct, time-limited access. Option D is wrong because Azure File Sync is for hybrid file sync, not secure sharing of datasets.

Answer

Azure Blob Storage with SFTP protocol enabled

Answer

Azure Data Share with snapshot-based sharing

Answer

Azure File Sync with on-premises file servers

Question 13

A company is using Microsoft Defender for Cloud to secure their Azure environment. They have enabled the 'Defender for Cloud's integrated workload protection' plan for Azure SQL Database. Which TWO of the following security features are included in this plan?

Accepted Answer

Vulnerability assessment. Options C and E are correct. The 'Defender for Cloud's integrated workload protection' plan for Azure SQL Database includes vulnerability assessment (option C) and advanced threat protection (option E). Option A: Microsoft Purview Information Protection is a separate data governance and compliance solution, not part of Defender for Cloud's SQL plan. Option B: Azure Policy is a service for policy enforcement, not a security feature included in the Defender for SQL plan. Option D: Transparent Data Encryption (TDE) is a built-in encryption feature of Azure SQL Database, but it is not specifically a feature of the Defender plan; it is always enabled by default.

Answer

Microsoft Purview Information Protection

Answer

Azure Policy

Answer

Transparent Data Encryption (TDE)

Question 14

A company is deploying a new application that uses Azure Cosmos DB. The security requirements include: data encryption at rest, data encryption in transit, and the ability to audit all data access. Which THREE of the following should you implement?

Accepted Answer

Require TLS for all connections to Cosmos DB. Options B, D, and E are correct. Option B: Requiring TLS for all connections ensures encryption in transit. Option D: Enabling encryption at rest with customer-managed keys provides data encryption at rest with additional control. Option E: Enabling diagnostic logging for Cosmos DB allows auditing of all data access. Option A is incorrect because Azure SQL Database is a different service and not a security configuration for Cosmos DB. Option C is incorrect because Azure Active Directory authentication authenticates users but does not by itself encrypt data or provide encryption in transit.

Answer

Use Azure SQL Database instead of Cosmos DB

Answer

Use Azure Active Directory authentication for Cosmos DB

Question 15

Refer to the exhibit. What is the effect of this Azure Policy definition?

Accepted Answer

It denies creation or update of storage accounts that do not enforce HTTPS traffic.. The Azure Policy definition uses the 'deny' effect on storage accounts where 'supportsHttpsTrafficOnly' is set to false. This means it denies the creation or update of storage accounts that do not enforce HTTPS traffic. Option A is incorrect because the policy applies to storage accounts, not virtual networks, and the condition is about HTTPS traffic on storage accounts. Option C is incorrect because the effect is 'deny', not 'audit'. Option D is incorrect because the policy targets the storage account resource type, not blob services specifically. The condition checks the property 'supportsHttpsTrafficOnly' on the storage account, which corresponds to the 'Secure transfer required' setting.

Answer

It denies creation of virtual networks that are not using HTTPS.

Answer

It audits storage accounts to check if HTTPS traffic is enforced.

Answer

It denies creation of blob services that do not enforce HTTPS.