SC-100 Design security solutions for applications and data Practice Test 8 — 15 Questions

Question 1

Your organization is using Microsoft Sentinel for security information and event management (SIEM). You need to ensure that data from Azure Activity Logs is ingested into Sentinel. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Connect Azure Activity Logs via the Microsoft Sentinel data connector. You can connect Azure Activity Logs as a data connector in Microsoft Sentinel. Option A is wrong because Log Analytics workspace is the underlying storage, but the connection is made via data connectors. Option B is wrong because Azure Policy can enforce configuration but not directly ingest logs. Option C is wrong because Azure Monitor is a broader service; the specific connector is needed.

Answer

Configure a Log Analytics workspace to collect Activity Logs

Answer

Use Azure Policy to stream Activity Logs to Sentinel

Answer

Enable Azure Monitor to forward Activity Logs to Sentinel

Question 2

You are designing a secure access strategy for Azure App Service web applications. The requirements are: use Azure AD for authentication, restrict access to specific IP ranges, and require multi-factor authentication (MFA) for all users. Which two components should you configure? (Choose two.)

Accepted Answer

Configure Azure App Service authentication with Microsoft Entra ID. Option B is correct because configuring App Service authentication with Microsoft Entra ID (formerly Azure AD) enables the built-in Easy Auth middleware to authenticate users against the Entra ID identity provider, satisfying the requirement to use Microsoft Entra ID for authentication. Option C is correct because a Conditional Access policy in Microsoft Entra ID can enforce MFA for all users and apply named locations or IP-based conditions to restrict access to specific IP ranges, meeting both the MFA and IP restriction requirements at the identity layer. Option A is not correct because an NSG applied to the App Service subnet only filters network traffic by IP/port at the network layer and does not provide Microsoft Entra ID authentication or MFA. Option D is not correct because Azure Firewall filters inbound/outbound traffic but does not perform user authentication or MFA enforcement. Option E is not correct because registering the application in Microsoft Entra ID only creates the identity object/service principal; it does not by itself enable authentication, IP restrictions, or MFA.

Answer

Apply a network security group (NSG) to the App Service subnet

Answer

Deploy Azure Firewall to filter inbound traffic

Answer

Register the application in Microsoft Entra ID

Question 3

Refer to the exhibit. A security analyst is reviewing a Windows security event log from a domain controller. The event indicates an attempted logon failure. Which type of attack is most likely being attempted?

Accepted Answer

Brute-force password guessing attack. A brute-force password guessing attack, because a logon failure event on a domain controller most directly indicates repeated or attempted authentication with incorrect credentials, which is the signature of password guessing. Brute-force attacks generate failed logon events (e.g., Windows Security Event ID 4625) as the attacker tries multiple passwords against an account. In contrast, a Kerberos golden ticket attack (A) forges a TGT using the KRBTGT hash and typically does not produce logon failures, and a DCSync attack (B) abuses directory replication permissions to extract password hashes, not to guess passwords. A pass-the-hash attack (C) authenticates using a stolen NTLM hash and usually succeeds without failed logon attempts, so it does not match the failed-logon scenario.

Answer

Kerberos golden ticket attack

Answer

DCSync attack

Answer

Pass-the-hash attack

Question 4

Refer to the exhibit. A security architect is reviewing an Azure Policy definition. What is the effect of this policy?

Accepted Answer

Denies creation or update of storage accounts that do not require HTTPS traffic. The correct answer is C: the policy denies creation or update of storage accounts that do not require HTTPS traffic. In Azure Policy, a Deny effect blocks the request at the resource provider during create or update operations when the resource does not satisfy the condition, so a storage account with supportsHttpsTrafficOnly set to false would be rejected. Option A is incorrect because Modify effects change properties via remediation and do not block the request. Option B is incorrect because Audit only records non-compliance without preventing deployment. Option D is incorrect because DeployIfNotExists remediation tasks are triggered after evaluation and do not deny the original request.

Answer

Modifies storage accounts to enable HTTPS traffic only

Answer

Audits storage accounts that do not require HTTPS traffic

Answer

Deploys a remediation task to enable HTTPS traffic only

Question 5

A company uses Microsoft Sentinel for SIEM. They need to ensure that security events from Azure Active Directory (now Microsoft Entra ID) are ingested into Sentinel. Which data connector should they enable?

Accepted Answer

Microsoft Entra ID connector. The Microsoft Entra ID connector (option A) is correct because it is the built-in Microsoft Sentinel data connector designed to ingest sign-in logs, audit logs, and other security events from Microsoft Entra ID / Microsoft Entra ID. Enabling it streams Entra ID diagnostic logs into the Sentinel workspace for analytics and detection. The Office 365 connector (B) ingests Exchange, SharePoint, and Teams activity logs, not Entra ID sign-in or audit events. The Azure Activity connector (C) collects subscription-level control-plane operations from Azure Resource Manager, not directory events. The Microsoft Defender XDR connector (D) pulls alerts and incidents from Defender services rather than raw Entra ID security logs.

Answer

Office 365 connector

Answer

Azure Activity connector

Answer

Microsoft Defender XDR connector

Question 6

Refer to the exhibit. A security architect is reviewing the network configuration of an Azure App Service app named 'finance-app'. The app needs to be accessible from a backend subnet via private endpoint. Which additional configuration is required?

Accepted Answer

Create a private endpoint and associate it with the App Service. The correct option is C: Create a private endpoint and associate it with the App Service. For an Azure App Service app to be reachable from a backend subnet over a private IP, a private endpoint must be created and linked to the app, which provisions a private IP in the target subnet via Azure Private Link. Option A is wrong because setting publicNetworkAccess to Enabled exposes the app publicly rather than providing private access. Option B is wrong because regional VNet integration enables outbound traffic from the app into a VNet, not inbound private access to the app. Option D is wrong because IP-based SSL only binds a certificate to an IP address and does not create private connectivity.

Answer

Set publicNetworkAccess to Enabled

Answer

Configure regional VNet integration for the app

Answer

Enable IP-based SSL for the app

Question 7

A company uses Microsoft 365 and wants to protect sensitive documents from being shared externally. They need a solution that automatically classifies documents containing personally identifiable information (PII) and applies appropriate protection. Which two services should they combine?

Accepted Answer

Microsoft Purview Information Protection and Data Loss Prevention (DLP). Microsoft Purview Information Protection allows for classification and labeling of documents based on content, while Data Loss Prevention (DLP) policies can enforce actions such as blocking external sharing or applying encryption. Together, they provide automated protection for sensitive documents like those containing PII. Option D is correct because these two services work together to classify and protect documents. Option A is incorrect because Microsoft Defender for Cloud Apps focuses on SaaS app security and Intune is for device management; they do not directly classify documents. Option B is incorrect because Compliance Manager is for managing compliance posture, and Sentinel is a SIEM; they are not used for automatic document classification. Option C is incorrect because Azure Information Protection is a previous version, now part of Purview, and Microsoft Entra ID is an identity service; they do not provide the same integrated classification and DLP capabilities as the Purview solutions.

Answer

Microsoft Defender for Cloud Apps and Microsoft Intune

Answer

Microsoft Purview Compliance Manager and Microsoft Sentinel

Answer

Azure Information Protection and Microsoft Entra ID

Question 8

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft Teams. You need to prevent users from sharing credit card numbers in Teams chat messages. However, the policy should allow sharing with external vendors if they are in your organization's approved list. What should you configure?

Accepted Answer

Configure a DLP policy with a condition to block sharing of credit card numbers to external users except those from approved domains.. You can configure a DLP policy in Microsoft Purview to block sensitive data like credit card numbers in Teams messages, and use the 'Block sharing to external users except' condition to allow sharing with approved domains. This meets the requirement to prevent sharing with unauthorized external users while allowing sharing with approved vendors. Option B is wrong because blocking all external sharing is too restrictive and does not allow the approved external vendors. Option C is wrong because Information Protection labels do not have the granular control over sharing conditions based on external domains. Option D is wrong because sensitivity labels are not designed for DLP actions such as blocking sharing in Teams chat based on external approval.

Answer

Create a DLP policy that blocks credit card numbers and set the action to 'Block external sharing' for all external users.

Answer

Use Microsoft Purview Information Protection to automatically apply a 'Confidential' label to messages containing credit card numbers and block forwarding.

Answer

Create a sensitivity label for credit card data and publish it to Teams, then configure auto-labeling.

Question 9

Your team develops a web application hosted on Azure App Service. You need to secure the application against common web vulnerabilities like SQL injection and cross-site scripting. What should you implement?

Accepted Answer

Enable Azure Web Application Firewall (WAF) on Azure Front Door or Application Gateway.. The correct option is A: enabling Azure Web Application Firewall (WAF) on Azure Front Door or Application Gateway, because WAF provides managed rule sets (OWASP Core Rule Set) that inspect HTTP/HTTPS traffic and block layer 7 attacks such as SQL injection and cross-site scripting before they reach the App Service. Options B, C, and D do not address application-layer attacks: Key Vault with managed identity only protects secrets and credentials, NSGs filter traffic by IP/port/protocol at layers 3-4 and cannot detect SQLi or XSS payloads, and Azure DDoS Protection mitigates volumetric network-layer floods rather than web application vulnerabilities.

Answer

Store application secrets in Azure Key Vault and enable managed identity.

Answer

Configure Network Security Groups (NSGs) on the App Service subnet to restrict inbound traffic.

Answer

Enable Azure DDoS Protection on the virtual network.

Question 10

Your organization uses Microsoft Sentinel to detect threats. You need to design a solution that automatically remediates a detected threat on an Azure VM by isolating the VM from the network. What should you use?

Accepted Answer

Create a Microsoft Sentinel automation rule that triggers a playbook to run an Azure Automation runbook to modify the NSG.. Microsoft Sentinel can trigger a playbook (automation rule) that runs an Azure Automation runbook to modify the NSG and isolate the VM. Option B is wrong because Log Analytics workspace doesn't have remediation actions. Option C is wrong because Azure Policy is for compliance, not incident response. Option D is wrong because Defender for Cloud has some automation, but Sentinel playbook is the designed method for automated response.

Answer

Configure a Log Analytics workspace query to run on a schedule and automatically block the VM.

Answer

Use Azure Policy to audit and automatically remediate non-compliant VMs.

Answer

Enable Microsoft Defender for Cloud's 'Just-in-time VM access' policy.

Question 11

Your organization is deploying Microsoft Defender for Cloud Apps. You need to create a policy that blocks downloads of sensitive files from sanctioned cloud apps to unmanaged devices. What type of policy should you create?

Accepted Answer

Session policy. A session policy (option A) is correct because in Microsoft Defender for Cloud Apps, session policies are used with Conditional Access App Control to monitor and control user sessions in real time, including blocking downloads of sensitive files from sanctioned cloud apps to unmanaged devices. Session policies can apply actions such as block download, protect, or block based on the sensitivity of the content and the device state. App discovery policies (option B) are used to identify and assess shadow IT and unsanctioned apps, not to control file downloads in real time. Anomaly detection policies (option C) trigger alerts on unusual user behavior but do not enforce download blocking. Access policies (option D) in Defender for Cloud Apps are used to allow or block sign-ins to apps based on conditions, not to control in-session file download activity.

Answer

App discovery policy

Answer

Anomaly detection policy

Answer

Access policy

Question 12

Your organization uses Azure API Management (APIM) to expose APIs to external partners. You need to ensure that only authorized partners can access the APIs and that the API requests are rate-limited to prevent abuse. What should you implement?

Accepted Answer

Use a validate JWT policy to authenticate partners and a rate-limit by key policy to control request rates.. In Azure API Management, the validate-jwt policy validates OAuth 2.0/JWT bearer tokens issued by an identity provider (such as Microsoft Entra ID), ensuring only authorized partners with valid tokens can call the APIs, while the rate-limit-by-key policy throttles requests based on a key such as the subscription key or a claim (e.g., partner ID), directly preventing abuse. Together these policies satisfy both the authentication and rate-limiting requirements within the APIM policy pipeline. Option B does not fit because client certificate authentication alone does not provide token-based authorization and a global rate limit applies to all callers rather than per-partner, so one partner could exhaust the quota. Option C is insufficient because a subscription key is a shared secret that can be leaked and IP whitelisting is brittle and does not enforce per-partner request limits. Option D is incomplete because OAuth 2.0 tokens and Key Vault key storage address credential handling but do not themselves implement rate limiting in APIM.

Answer

Configure client certificate authentication and set a global rate limit in the APIM service.

Answer

Require a subscription key for each partner and configure IP whitelisting.

Answer

Use OAuth 2.0 tokens and store partner API keys in Azure Key Vault.

Question 13

Your organization uses Microsoft Purview to govern data assets across Azure and on-premises. You need to automatically classify sensitive data such as credit card numbers in Azure SQL Database. What should you use?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map is the correct choice because it is the component that scans and automatically classifies data sources such as Azure SQL Database, detecting sensitive information types like credit card numbers and applying classifications. It builds the metadata catalog and applies built-in or custom classification rules during scans, which is exactly what's needed for automated sensitive-data discovery. Microsoft Defender for Cloud provides security posture management and threat protection, not data classification. Microsoft Entra ID handles identity and access management, and Microsoft Sentinel is a SIEM/SOAR solution for security analytics, so neither performs data classification.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Entra ID

Answer

Microsoft Sentinel

Question 14

You are reviewing the ARM template snippet for an Azure Storage container. What does the 'denyEncryptionScopeOverride' property set to 'true' ensure?

Accepted Answer

Users cannot override the default encryption scope for blobs in this container.. Option D is correct because setting denyEncryptionScopeOverride to true on a container prevents clients from specifying a different encryption scope when uploading blobs, forcing them to use the container's default encryption scope. This property is specifically about locking the encryption scope at the container level, not about enabling or requiring encryption itself. Option A is wrong because double encryption is configured via infrastructure encryption settings, not this property. Option B is wrong because encryption at rest is always enabled for Azure Storage blobs by default and is not controlled by denyEncryptionScopeOverride. Option C is wrong because customer-managed keys are configured through the account's encryption key source settings, not through this container property.

Answer

Double encryption is enabled for the container.

Answer

Encryption at rest is required for all blobs in the container.

Answer

The container automatically uses a customer-managed key for encryption.

Question 15

Your organization is designing a solution to protect sensitive data in Microsoft 365. You need to implement Microsoft Purview Data Loss Prevention (DLP) policies. Which TWO actions can a DLP policy take when a match occurs? (Choose TWO.)

Accepted Answer

Block the sharing of sensitive information.. Option D is correct because Microsoft Purview DLP policies can block sharing of sensitive information across workloads such as Exchange Online, SharePoint, OneDrive, and Teams, preventing users from sending or sharing content that matches a DLP rule. Option E is correct because DLP policies can display policy tips to users in supported apps (for example, Outlook, Word, Excel, and Teams), notifying them that content matches a rule and offering override or report options. Option A is not a native DLP action; encryption with Azure Information Protection is typically achieved through sensitivity labels or auto-labeling policies, not directly as a DLP policy action. Option B is not a standard DLP action in Microsoft Purview; DLP can block, restrict access, or notify, but it does not quarantine files for administrator review. Option C is not a DLP policy action; automatically applying a sensitivity label is performed by auto-labeling policies in Microsoft Purview, not by DLP policies.

Answer

Encrypt the file with Azure Information Protection.

Answer

Quarantine the file for administrator review.

Answer

Automatically apply a sensitivity label.