SC-100 Design security solutions for applications and data Practice Test 9 — 15 Questions

Question 1

Your organization is using Microsoft Sentinel for security operations. Which THREE data sources can be connected to Microsoft Sentinel out of the box? (Choose THREE.)

Accepted Answer

Azure Active Directory (now Microsoft Entra ID). Options A (Microsoft Entra ID/Entra ID), B (AWS CloudTrail), and D (Microsoft 365 Defender) are all supported out-of-the-box data connectors in Microsoft Sentinel. Option C (Azure DevOps) is not a built-in connector; it requires a custom API or solution. Option E (Power BI) is not a data source connector for Sentinel.

Answer

Azure DevOps

Answer

Power BI

Question 2

A company uses Microsoft Defender for Cloud Apps to enforce session policies. The security team needs to block downloads of sensitive files from Microsoft 365 when accessed from unmanaged devices. Which type of policy should they configure?

Accepted Answer

Session policy. Session policy. In Microsoft Defender for Cloud Apps, session policies are used with Conditional Access App Control to monitor and control user sessions in real time, including blocking downloads of sensitive files from Microsoft 365 when accessed from unmanaged devices. This is the specific policy type designed for session-based enforcement, such as blocking downloads, uploads, or copy/paste actions during an active session. A file policy (A) applies to files in connected cloud apps for governance and alerting but does not control live session actions like downloads from unmanaged devices. A DLP policy in Microsoft 365 (B) enforces data protection within Microsoft 365 workloads but does not provide the same session proxy-based control for unmanaged device access. An access policy (D) in Defender for Cloud Apps is used to allow or block app access based on conditions, not to block downloads within an active session.

Answer

File policy

Answer

Data Loss Prevention (DLP) policy in Microsoft 365

Answer

Access policy

Question 3

A healthcare organization is designing a zero-trust application security strategy. They use Microsoft Entra ID for identity and plan to deploy a legacy on-premises web application with no modern authentication support. The solution must ensure that only authorized users can access the app and that access is logged for auditing. Which Microsoft security service should they use to secure access?

Accepted Answer

Microsoft Entra application proxy. Microsoft Entra application proxy (option B) is correct because it is designed to publish on-premises web applications, including legacy apps without modern authentication support, and enforce Entra ID pre-authentication plus conditional access before traffic reaches the app, while also providing access logging for auditing. It fits the zero-trust scenario by brokering remote access through the Application Proxy connector without exposing the app directly to the internet. Azure AD B2C (option A) is for customer identity and access management for consumer-facing apps, not for securing internal legacy on-premises apps. Microsoft Defender for Cloud Apps (option C) is a CASB for discovering, monitoring, and controlling cloud app usage, not for publishing and pre-authenticating on-premises web apps. Microsoft Intune (option D) is for device and mobile application management, not for brokering authenticated access to legacy on-premises web applications.

Answer

Azure AD B2C

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Intune

Question 4

A company uses Microsoft Sentinel for security operations. They want to collect logs from a custom application running on Azure Virtual Machines. The application writes logs to a local file. Which data connector should they use?

Accepted Answer

Custom Logs via Log Analytics agent. The correct option is D, Custom Logs via Log Analytics agent, because Microsoft Sentinel can ingest arbitrary text-based log files from Azure VMs by installing the Log Analytics agent (MMA/AMA) and defining a custom log table that points to the local file path, which is exactly the scenario of a custom application writing to a local file. Application Insights (A) is an APM service for instrumented application telemetry, not for collecting pre-existing local log files from VMs. Syslog (B) only handles syslog-format messages from Linux/network devices, and Windows Event Forwarding (C) only collects Windows Event Log data, so neither fits a custom application's local log file.

Answer

Application Insights

Answer

Syslog

Answer

Windows Event Forwarding

Question 5

A security architect is designing a data protection strategy for a Microsoft 365 tenant. The company must prevent users from sharing sensitive documents with external users via SharePoint Online. They want to apply a policy that automatically detects sensitive content and blocks external sharing. Which Microsoft Purview solution should they use?

Accepted Answer

Data Loss Prevention (DLP) policy. Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive data and block external sharing. Option C is correct. Option A is wrong because sensitivity labels require manual application or automatic classification, but blocking external sharing is typically done by DLP. Option B is wrong because retention policies are for data retention, not blocking sharing. Option D is wrong because Microsoft Purview Information Protection is the umbrella, but the specific policy is DLP.

Answer

Sensitivity labels

Answer

Retention policies

Answer

Microsoft Purview Information Protection

Question 6

A company uses Microsoft Defender for Cloud to protect their hybrid environment. They have on-premises servers that are monitored by Microsoft Defender for Servers. The security team notices that some servers are missing critical security updates. They want to automatically remediate missing updates on these servers. Which feature should they enable?

Accepted Answer

Azure Update Manager. Azure Update Manager (option C) is the correct choice because it is the native Azure service designed to assess and automatically remediate missing OS security updates across Azure, on-premises, and multicloud servers, including those onboarded to Microsoft Defender for Servers. It provides update assessment, scheduling, and automatic patching for Windows and Linux machines, which directly addresses the team's need to remediate missing updates on their hybrid servers. Adaptive Application Controls (option A) only create allowlist/denylist rules for applications to control execution and do not patch operating systems. Azure Automation Update Management (option B) is the legacy predecessor that has been superseded by Azure Update Manager, so it is not the recommended feature. Just-in-Time VM access (option D) only restricts inbound management ports on VMs and has nothing to do with update remediation.

Answer

Adaptive Application Controls

Answer

Azure Automation Update Management

Answer

Just-in-Time (JIT) VM access

Question 7

A company uses Microsoft Intune to manage corporate devices. They want to ensure that only compliant devices can access corporate email in Outlook Mobile. Which type of policy should they configure?

Accepted Answer

Conditional Access policy. Conditional Access policy, because Conditional Access is the Intune/Microsoft Entra mechanism that enforces access decisions such as requiring a device to be compliant before granting access to corporate resources like Exchange Online for Outlook Mobile. In this scenario, the company needs an access control that evaluates device compliance at sign-in and blocks noncompliant devices, which is exactly what a Conditional Access policy with a 'Require device to be marked as compliant' grant control does. A compliance policy (D) only defines and evaluates compliance state but does not itself block or grant access, and a device configuration policy (B) merely configures settings on devices without enforcing access. An app protection policy (A) protects app data with PINs and encryption but does not gate access to corporate email based on device compliance.

Answer

App protection policy

Answer

Device configuration policy

Answer

Compliance policy

Question 8

Refer to the exhibit. A security administrator is reviewing a Conditional Access policy JSON. They want to ensure that users with medium risk level are prompted for multi-factor authentication (MFA), while high-risk users are blocked. The policy is not working as expected. Which issue is present in the policy?

Accepted Answer

The policy requires both user and sign-in risk to be high to block, but a user with high user risk and low sign-in risk would not be blocked. The correct answer is B: the policy's block condition requires both user risk and sign-in risk to be high, so a user with high user risk but low sign-in risk would not be blocked as intended. In Microsoft Entra Conditional Access, user risk and sign-in risk are separate conditions, and if the JSON combines them so that both must be 'high' for the block to apply, the policy fails to block all high-risk users. The intended design should block when user risk is high, regardless of sign-in risk, or use separate grant controls for medium-risk MFA and high-risk block. Option A is wrong because report-only mode would not enforce MFA or blocking at all. Option C is wrong because the scenario describes a logic problem, not invalid JSON syntax. Option D is wrong because combining conditions with 'Or' would make the policy broader, not narrower, and would not explain the failure to block high-risk users.

Answer

The policy mode should be 'report-only'

Answer

The JSON syntax is invalid

Answer

The conditions are combined with 'Or' instead of 'And'

Question 9

Refer to the exhibit. A security architect is reviewing an ARM template that deploys an Azure Storage container. They want to ensure the container is not publicly accessible. What is the security implication of this template?

Accepted Answer

The template does not configure network rules, so the container may be accessible from the internet, but only to authenticated users. Option D is correct because the ARM template does not define any network rules (such as a virtual network rule or IP firewall rule) for the storage account, so the storage endpoint remains reachable from the internet; however, since public blob access is not enabled, anonymous access is denied and only authenticated requests with valid credentials or SAS tokens can succeed. This means the container is not publicly accessible in the anonymous sense, but the lack of network restrictions still exposes the endpoint to authenticated access from any network. Option A is wrong because nothing in the template enables anonymous public access to the container. Option B is wrong because versioning is a data-protection feature, not a public-access control, and it is not the security implication being asked about. Option C is wrong because encryption at rest is enabled by default for Azure Storage and is unrelated to whether the container is publicly reachable.

Answer

The container allows public access

Answer

The template creates a container with versioning enabled

Answer

The template enables encryption at rest

Question 10

Your organization uses Microsoft Sentinel to detect threats. You need to ensure that sensitive data stored in Azure SQL Database is protected from unauthorized access by Sentinel playbooks. What should you implement?

Accepted Answer

Use a managed identity assigned to the playbook to authenticate to Azure SQL. The correct option is D: use a managed identity assigned to the playbook to authenticate to Azure SQL. In Microsoft Sentinel, playbooks are Logic Apps, and when they need to access Azure SQL Database, the recommended approach is to assign a managed identity to the playbook and grant that identity the appropriate database permissions, so no credentials are stored and access is scoped to the playbook. This directly protects sensitive data by ensuring only the authorized playbook identity can authenticate to Azure SQL. Option A (dynamic data masking) limits data exposure in query results but does not control which principals can access the database. Option B (CMK for TDE) protects data at rest via encryption key management, not playbook authorization. Option C (SQL firewall rules for Sentinel IPs) is impractical because Sentinel playbooks run as Logic Apps without a fixed, reliable set of Sentinel IP addresses, and firewall rules alone do not authenticate the playbook.

Answer

Enable dynamic data masking on the SQL database

Answer

Use customer-managed keys (CMK) for SQL Transparent Data Encryption

Answer

Configure Azure SQL firewall rules to allow only Sentinel IP addresses

Question 11

Your organization is designing a solution to protect sensitive data in Microsoft SharePoint Online. You need to ensure that documents containing credit card numbers are automatically encrypted when shared with external users. What should you configure?

Accepted Answer

An auto-labeling policy for sensitivity labels with encryption. The correct option is C: an auto-labeling policy for sensitivity labels with encryption. In Microsoft Purview, auto-labeling policies scan SharePoint Online content for sensitive information types such as credit card numbers and automatically apply a sensitivity label; when that label is configured with encryption, the document is encrypted and the protection travels with the file even when shared with external users. Option A is wrong because a DLP policy that blocks sharing prevents external sharing rather than encrypting the document, and DLP does not itself apply encryption. Option B is wrong because SharePoint IRM encrypts files at rest in the library and relies on the service to enforce permissions, but it does not automatically classify and encrypt documents based on sensitive content detection. Option D is wrong because a retention policy with a hold only preserves content for compliance and does not encrypt it.

Answer

A Data Loss Prevention (DLP) policy that blocks sharing

Answer

Information Rights Management (IRM) for SharePoint

Answer

A retention policy with a hold

Question 12

Your company is designing a zero-trust security posture for a new application in Azure. The application uses Azure Functions, Azure SQL Database, and Azure Blob Storage. You need to ensure that data in transit is encrypted and that the application can authenticate without storing secrets in code. Which THREE actions should you take?

Accepted Answer

Enable 'Enforce minimum TLS version' on the Blob Storage account. Options A, B, and C are correct. Enforcing a minimum TLS version on Blob Storage (A) and configuring the application to use TLS 1.2 or higher (B) both ensure data in transit is encrypted. Using managed identity for Azure Functions to access Azure SQL Database (C) provides secretless authentication. Option D (CMK) encrypts data at rest, not in transit. Option E (firewall IP restriction) controls network access but does not encrypt data in transit.

Answer

Enable customer-managed keys (CMK) for Azure SQL Database

Answer

Configure the Azure SQL firewall to allow only the Functions IP range

Question 13

Your organization uses Microsoft Defender for Cloud to assess security posture. You need to ensure that your Azure App Service web applications are protected against common web vulnerabilities like SQL injection. What should you enable?

Accepted Answer

Web Application Firewall (WAF) on Azure Front Door. The correct option is A: Web Application Firewall (WAF) on Azure Front Door. A WAF inspects incoming HTTP/HTTPS traffic and applies managed rule sets (such as the OWASP Core Rule Set) to block common web exploits like SQL injection and cross-site scripting before they reach the App Service. Just-in-time (JIT) VM access (B) only brokers temporary, approved RDP/SSH access to virtual machines and has no bearing on web application layer attacks. Adaptive Application Controls (C) are an Azure Security Center/Defender for Cloud feature that whitelists processes on VMs to detect anomalous execution, not HTTP payloads. Azure DDoS Protection (D) mitigates volumetric and protocol-level network floods, not application-layer injection attacks.

Answer

Just-in-time (JIT) VM access

Answer

Adaptive Application Controls

Answer

Azure DDoS Protection

Question 14

Your company is developing a Microsoft Teams app that accesses user profiles. You need to ensure the app only accesses minimal required data. What should you implement?

Accepted Answer

Delegated permissions with User.Read. The correct option is C: Delegated permissions with User.Read. Delegated permissions let the app act on behalf of the signed-in user, and User.Read is the least-privileged Microsoft Graph scope that allows reading the signed-in user's own profile, satisfying the requirement for minimal data access. Option A is unnecessary because admin consent for all scopes grants far broader access than needed. Option B is wrong because application permissions run without a signed-in user and typically require broader tenant-wide access. Option D is excessive since User.Read.All allows reading all users' full profiles, not just the current user's minimal data.

Answer

Admin consent for all scopes

Answer

Application permissions for Microsoft Graph

Answer

Delegated permissions with User.Read.All

Question 15

Refer to the exhibit. This is a risk alert from Microsoft Entra ID Identity Protection for user jdoe@contoso.com. You are designing an automated response using Microsoft Sentinel. Which condition should you use to trigger a high-severity incident?

Accepted Answer

If the user risk level is 'high'. The correct condition is A: trigger the high-severity incident when the user risk level is 'high'. In Microsoft Entra ID Identity Protection, user risk represents the probability that a given identity has been compromised, and a 'high' user risk is the strongest aggregate signal for an account-level compromise, making it the appropriate trigger for a high-severity Microsoft Sentinel incident. Option B is not the best fit because sign-in risk is scoped to a single authentication attempt rather than the overall user account. Option C is too narrow, since 'leakedCredentials' is only one risk detection type and does not by itself indicate the highest severity. Option D is incorrect because 'medium' user risk is a lower severity than 'high' and would not justify a high-severity incident.

Answer

If the sign-in risk level is 'high'

Answer

If the risk event types include 'leakedCredentials'

Answer

If the user risk level is 'medium'