SC-100 Design security solutions for applications and data Practice Test 9 — 15 Questions

Question 1

Your organization is developing a new application that will use Azure Cosmos DB. The security team requires that all data be encrypted at rest and in transit, and that access to the database is limited to specific Azure services and IP addresses. The application will run on Azure VMs. Which three actions should you take? (Choose three.)

Accepted Answer

Configure Cosmos DB to require TLS for all client connections.. Option A, B, and D are correct. Option A: Enforce TLS for all requests to Cosmos DB for encryption in transit. Option B: Use a private endpoint for Cosmos DB to restrict network access. Option D: Enable encryption at rest (which is on by default) and ensure customer-managed keys if required. Option C is wrong because firewall rules are needed, but they should be set to allow only the VM's public IP or the private endpoint; allowing all Azure services is too permissive. Option E is wrong because Azure SQL Database is not Cosmos DB.

Answer

Use Azure SQL Database instead of Cosmos DB for better security features.

Answer

Configure the Cosmos DB firewall to allow access from all Azure services.

Question 2

Your organization is using Microsoft Defender for Cloud to secure applications running on Azure. You need to ensure that all Azure Storage accounts have secure transfer required enabled. What is the BEST way to enforce this?

Accepted Answer

Assign an Azure Policy initiative that includes the built-in policy 'Secure transfer to storage accounts should be enabled' with a 'Deny' effect.. Option B is correct because Azure Policy can audit and enforce compliance at scale. Option A is wrong because while Defender for Cloud can detect the issue, it does not automatically enforce. Option C is wrong because Azure Blueprints is deprecated; Azure Policy is the correct tool. Option D is wrong because RBAC controls permissions, not configuration.

Answer

Create a custom recommendation in Microsoft Defender for Cloud to alert when storage accounts do not have secure transfer required.

Answer

Use Azure Blueprints to apply the setting to all subscriptions.

Answer

Grant the 'Storage Account Contributor' role to a security group that will manually enable the setting.

Question 3

You are designing a solution for a multi-national corporation that uses Microsoft Purview to govern data across Azure SQL Database, Azure Data Lake Storage, and Microsoft 365. The data classification labels must be automatically applied based on sensitive data types such as credit card numbers and passport numbers. Which Microsoft Purview capability should you use?

Accepted Answer

Microsoft Purview Data Map with automatic classification. Option B is correct because Microsoft Purview Data Map with automatic classification scanning can scan data sources and apply sensitivity labels based on built-in or custom data types. Option A is wrong because Information Protection is for labeling and protection in Microsoft 365, not for scanning data sources. Option C is wrong because DLP policies are for preventing data loss, not for automatic classification. Option D is wrong because Audit is for logging activities.

Answer

Microsoft Purview Data Loss Prevention (DLP) policies

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Information Protection

Question 4

A company is building a new SaaS application that will be used by external customers. The application uses Azure API Management (APIM) to expose APIs. The security requirements include: (1) Only authenticated and authorized customers can call the APIs, (2) The API keys must be rotated automatically every 90 days, (3) The APIs must be protected against common web vulnerabilities. What should you implement?

Accepted Answer

Use OAuth 2.0 with Azure AD (Entra ID) for authentication, configure API key rotation in APIM policies, and enable Azure Web Application Firewall (WAF) in front of APIM.. Option D is correct because it combines OAuth 2.0 for authentication and authorization, automatic key rotation via APIM policies, and Azure WAF for vulnerability protection. Option A is wrong because IP whitelisting is not a strong authentication method. Option B is wrong because client certificates require certificate management and do not protect against web vulnerabilities. Option C is wrong because rate limiting does not address authentication or vulnerability protection.

Answer

Use IP whitelisting in APIM to restrict access to known customer IPs and enable API key rotation manually every 90 days.

Answer

Require client certificates for authentication and configure APIM to automatically rotate the certificates.

Answer

Implement OAuth 2.0 with JWT tokens and use rate limiting to mitigate attacks.

Question 5

Your organization uses Microsoft 365 and wants to prevent users from sharing sensitive documents externally via email. The solution must be able to detect credit card numbers and automatically block the email. Which technology should you use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online. Option A is correct because Microsoft Purview DLP policies can automatically detect sensitive information types like credit card numbers and block emails. Option B is wrong because Sensitivity labels are for classification, not for blocking. Option C is wrong because AIP (now part of Purview) is for labeling, not for blocking. Option D is wrong because Microsoft Defender for Office 365 focuses on phishing and malware, not on DLP.

Answer

Microsoft Purview Sensitivity labels with auto-classification

Answer

Microsoft Defender for Office 365 Safe Attachments

Answer

Azure Information Protection (AIP) unified labeling client

Question 6

You are designing a secure data sharing solution for a research organization that needs to share large datasets with external universities. The data must be encrypted at rest and in transit, and access must be time-limited. The solution should minimize administrative overhead. What should you use?

Accepted Answer

Azure Storage with shared access signatures (SAS) and Azure Key Vault. Option D is correct because Azure Storage with SAS tokens provides time-limited access, encryption at rest (SSE), and encryption in transit (HTTPS). Option A is wrong because Azure File Sync focuses on syncing files, not secure sharing. Option B is wrong because Azure Data Share is more for periodic snapshots, not direct access. Option C is wrong because SFTP requires more administrative overhead for user management.

Answer

Azure Blob Storage with SFTP protocol enabled

Answer

Azure Data Share with snapshot-based sharing

Answer

Azure File Sync with on-premises file servers

Question 7

A company is using Microsoft Defender for Cloud to secure their Azure environment. They have enabled the 'Defender for Cloud's integrated workload protection' plan for Azure SQL Database. Which TWO of the following security features are included in this plan?

Accepted Answer

Vulnerability assessment. Option A and D are correct. Option A: Vulnerability assessment is included in the Defender for SQL plan. Option D: Advanced Threat Protection (ATP) is included. Option B: Azure SQL Database always encrypts data at rest with TDE by default, but it is not a specific feature of the Defender plan. Option C: Information Protection is a Microsoft Purview feature, not Defender for Cloud. Option E: Azure Policy is a separate governance tool.

Answer

Microsoft Purview Information Protection

Answer

Azure Policy

Answer

Transparent Data Encryption (TDE)

Question 8

You are designing a solution to protect a web application hosted on Azure App Service. The application uses Azure SQL Database and stores sensitive customer data. You need to ensure that the data is encrypted at rest and in transit, and that the application is protected from common web attacks. Which TWO of the following should you implement?

Accepted Answer

Enforce TLS for Azure SQL Database connections. Option A and D are correct. Option A: Azure WAF protects against common web attacks like SQL injection and XSS. Option D: Azure SQL Database always encrypts data at rest with TDE, and enforcing TLS ensures encryption in transit. Option B is wrong because DDoS Protection is for network-layer attacks, not application-layer. Option C is wrong because Network Security Groups (NSGs) are for network traffic filtering, not for encrypting data in transit.

Answer

Azure Private Link for App Service

Answer

Network Security Groups (NSGs) on the subnet

Answer

Azure DDoS Protection Standard

Question 9

A company is deploying a new application that uses Azure Cosmos DB. The security requirements include: data encryption at rest, data encryption in transit, and the ability to audit all data access. Which THREE of the following should you implement?

Accepted Answer

Require TLS for all connections to Cosmos DB. Option A, D, and E are correct. Option A: Cosmos DB requires TLS for all client connections by default, ensuring encryption in transit. Option D: Encryption at rest is enabled by default; using customer-managed keys provides additional control. Option E: Diagnostic logging enables auditing of data access. Option B is wrong because Azure SQL Database is a different service. Option C is wrong because Azure Active Directory (now Entra ID) authentication is supported but does not by itself encrypt data.

Answer

Use Azure SQL Database instead of Cosmos DB

Answer

Use Azure Active Directory authentication for Cosmos DB

Question 10

Refer to the exhibit. What is the effect of this Azure Policy definition?

Accepted Answer

It denies creation or update of storage accounts that do not enforce HTTPS traffic.. Option A is correct. The policy checks if the storage account does not have 'Secure transfer required' enabled (supportsHttpsTrafficOnly equals false) and denies creation or update. Option B is wrong because the effect is 'deny', not 'audit'. Option C is wrong because the condition is on storage accounts, not on virtual networks. Option D is wrong because the policy does not apply to blob services.

Answer

It denies creation of virtual networks that are not using HTTPS.

Answer

It audits storage accounts to check if HTTPS traffic is enforced.

Answer

It denies creation of blob services that do not enforce HTTPS.

Question 11

Refer to the exhibit. A security administrator needs to ensure that the storage account 'securestore' is compliant with the company policy that requires encryption at rest using customer-managed keys and network access restricted to a specific virtual network. Which of the following statements is correct?

Accepted Answer

The storage account is compliant because it uses customer-managed keys from Key Vault and network access is restricted to a specific virtual network.. Option A is correct. The output shows 'keySource' is 'Microsoft.Keyvault' indicating customer-managed keys. Network ACLs have 'defaultAction': 'Deny' and a virtual network rule allowing traffic from vnet1/subnet1. Option B is wrong because the encryption is customer-managed, not Microsoft-managed. Option C is wrong because there is a VNet rule, but the default action is Deny, which restricts access. Option D is wrong because the output shows encryption is enabled for both blob and file services.

Answer

The storage account is compliant only if encryption is enabled for blob and file services.

Answer

The storage account is non-compliant because it uses Microsoft-managed keys for encryption.

Answer

The storage account is non-compliant because network access is allowed from any virtual network.

Question 12

Refer to the exhibit. What is the purpose of this KQL query?

Accepted Answer

To retrieve SQL injection alerts from the past 7 days with specific fields.. Option B is correct. The query filters for SQL injection alerts in the last 7 days and projects relevant columns. Option A is wrong because it does not show all alerts, only SQL injection ones. Option C is wrong because it does not join with other tables. Option D is wrong because it does not aggregate or count alerts.

Answer

To count the number of SQL injection alerts by severity.

Answer

To join security alerts with other data sources to find compromised entities.

Answer

To list all security alerts generated in the last 7 days.

Question 13

Your organization is deploying a customer-facing web application in Azure. The application must authenticate users via Microsoft Entra ID and access Microsoft Graph to read user profiles. The security team requires that the application never has access to user passwords. Which authentication flow should you recommend?

Accepted Answer

OAuth 2.0 authorization code flow with PKCE. Option B is correct because the OAuth 2.0 authorization code flow with PKCE is the recommended flow for native and web apps that need to access APIs without exposing user credentials. Option A is wrong because client credentials flow is for server-to-server scenarios without a user context. Option C is wrong because device authorization flow is for devices with limited input capabilities. Option D is wrong because implicit grant flow is deprecated due to security concerns.

Answer

OAuth 2.0 implicit grant flow

Answer

OAuth 2.0 device authorization flow

Answer

OAuth 2.0 client credentials grant flow

Question 14

Your company uses Microsoft Defender for Cloud Apps to discover shadow IT. You need to ensure that data exfiltration from sanctioned cloud apps is blocked in real-time. Which control should you configure?

Accepted Answer

Conditional Access App Control. Option C is correct because session-based Conditional Access App Control enforces real-time monitoring and control of app sessions. Option A is wrong because app connectors provide read-only monitoring. Option B is wrong because cloud discovery only identifies apps, not controls. Option D is wrong because IP address ranges are used for location policies, not session control.

Answer

IP address ranges

Answer

Cloud discovery

Answer

App connector

Question 15

A healthcare organization uses Microsoft Purview Information Protection to classify and protect patient data. They want to automatically apply a 'High Confidentiality' label to any document containing a patient ID pattern (###-####). The label should also encrypt the document. Which configuration should they use?

Accepted Answer

Sensitivity label with auto-labeling for sensitive info types. Option B is correct because a sensitivity label with auto-labeling for files containing sensitive info types (like patient IDs) can apply encryption automatically. Option A is wrong because a retention label only manages retention, not encryption. Option C is wrong because a DLP policy alerts but does not automatically label. Option D is wrong because a trainable classifier requires training and does not use a regex pattern.

Answer

Retention label with auto-labeling policy

Answer

Data Loss Prevention (DLP) policy with a block action

Answer

Trainable classifier with a retention policy