SC-100 Design security solutions for applications and data Practice Test 9 — 15 Questions

Question 1

Refer to the exhibit. A security administrator needs to ensure that the storage account 'securestore' is compliant with the company policy that requires encryption at rest using customer-managed keys and network access restricted to a specific virtual network. Which of the following statements is correct?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The storage account is compliant because it uses customer-managed keys from Key Vault and network access is restricted to a specific virtual network.. The exhibit shows 'keySource': 'Microsoft.Keyvault' which indicates customer-managed keys from Azure Key Vault. Additionally, the network ACL has 'defaultAction': 'Deny' and a virtual network rule allowing traffic from vnet1/subnet1, meaning access is restricted to that specific virtual network. Option A is incorrect because the storage account already has encryption enabled for blob and file services (as seen in the output), but that's not the reason for compliance—the key point is the customer-managed keys and network restriction. Option B is incorrect because the encryption uses customer-managed keys, not Microsoft-managed keys. Option D is incorrect because the network access is restricted to a specific virtual network (vnet1/subnet1), not allowed from any virtual network.

Answer

The storage account is compliant only if encryption is enabled for blob and file services.

Answer

The storage account is non-compliant because it uses Microsoft-managed keys for encryption.

Answer

The storage account is non-compliant because network access is allowed from any virtual network.

Question 2

Refer to the exhibit. What is the purpose of this KQL query?

Accepted Answer

To retrieve SQL injection alerts from the past 7 days with specific fields.. The query filters for SQL injection alerts in the last 7 days and projects relevant columns. Option A is wrong because it does not show all alerts, only SQL injection ones. Option C is wrong because it does not join with other tables. Option D is wrong because it does not aggregate or count alerts.

Answer

To count the number of SQL injection alerts by severity.

Answer

To join security alerts with other data sources to find compromised entities.

Answer

To list all security alerts generated in the last 7 days.

Question 3

Your organization is deploying a customer-facing web application in Azure. The application must authenticate users via Microsoft Entra ID and access Microsoft Graph to read user profiles. The security team requires that the application never has access to user passwords. Which authentication flow should you recommend?

Accepted Answer

OAuth 2.0 authorization code flow with PKCE. The OAuth 2.0 authorization code flow with PKCE is the recommended flow for public clients like web applications that need to authenticate users and access APIs without exposing user credentials. It provides enhanced security by using a code challenge and verifier to prevent authorization code interception attacks. Option A (implicit grant flow) is deprecated due to security vulnerabilities, such as access token exposure in the URL. Option B (device authorization flow) is designed for devices with limited input capabilities, not for web applications. Option C (client credentials grant flow) is intended for server-to-server scenarios where no user is involved, and it does not authenticate individual users.

Answer

OAuth 2.0 implicit grant flow

Answer

OAuth 2.0 device authorization flow

Answer

OAuth 2.0 client credentials grant flow

Question 4

Your company uses Microsoft Defender for Cloud Apps to discover shadow IT. You need to ensure that data exfiltration from sanctioned cloud apps is blocked in real-time. Which control should you configure?

Accepted Answer

Conditional Access App Control. To block data exfiltration from sanctioned cloud apps in real-time, you need to use session-based Conditional Access App Control. This leverages Microsoft Defender for Cloud Apps with Azure AD Conditional Access to monitor and control app sessions in real time, allowing actions like blocking downloads or restricting access. Option B (IP address ranges) is used for location-based policies, not session-level control. Option C (Cloud discovery) is used to identify shadow IT, not to control sanctioned apps. Option D (App connector) provides API-based read-only monitoring and does not enforce real-time session controls.

Answer

IP address ranges

Answer

Cloud discovery

Answer

App connector

Question 5

A healthcare organization uses Microsoft Purview Information Protection to classify and protect patient data. They want to automatically apply a 'High Confidentiality' label to any document containing a patient ID pattern (###-####). The label should also encrypt the document. Which configuration should they use?

Accepted Answer

Sensitivity label with auto-labeling for sensitive info types. A sensitivity label with auto-labeling for sensitive info types (e.g., patient IDs) can automatically apply the label and enforce encryption. Option A is wrong because retention labels manage retention, not encryption. Option B is wrong because a DLP policy can detect and block, but does not automatically apply labels. Option D is wrong because trainable classifiers require training and do not use a simple regex pattern.

Answer

Retention label with auto-labeling policy

Answer

Data Loss Prevention (DLP) policy with a block action

Answer

Trainable classifier with a retention policy

Question 6

Your organization uses Microsoft Sentinel to centralize security monitoring. You need to detect anomalous access to a critical Azure SQL Database from unusual geographic locations. Which data connector and analytic rule should you use?

Accepted Answer

Azure SQL Database connector and a custom scheduled query rule with geo-location. The Azure SQL Database connector ingests diagnostic logs containing connection events, and a custom scheduled query rule can be configured to detect anomalies by geographic location using geo-location enrichment. Option B is incorrect because Azure AD sign-in logs cover user authentication to Azure AD, not database-level connections. Option C is incorrect because Windows Security Events are for on-premises servers, not Azure SQL Database. Option D is incorrect because Azure Activity logs track control plane operations (e.g., resource creation, deletion), not data plane access like SQL queries or connections.

Answer

Azure Active Directory connector and an anomaly rule for sign-ins

Answer

Windows Security Events connector and a rule for failed logins

Answer

Azure Activity connector and a rule for resource deletion

Question 7

Your organization uses Microsoft Entra Verified ID to issue verifiable credentials to employees. You need to design a solution that allows employees to prove their employment status to third-party apps without exposing their full identity. What should you implement?

Accepted Answer

Verifiable credentials with a custom credential type. A verifiable credential can contain only the attributes required (e.g., employment status) and is presented via a wallet. Option A is wrong because a custom role does not issue credentials. Option C is wrong because managed identities are for Azure resources, not user identity. Option D is wrong because Conditional Access controls access but does not issue proofs.

Answer

Microsoft Entra ID custom roles

Answer

Azure managed identities

Answer

Conditional Access policy with session controls

Question 8

Your organization is developing a Power BI dashboard that uses data from an Azure SQL Database. The data includes personally identifiable information (PII). You need to mask the PII from certain users while allowing full access to data owners. What should you use?

Accepted Answer

Dynamic data masking in Azure SQL Database and row-level security in Power BI. Dynamic data masking in Azure SQL Database can mask PII columns at the database level, and row-level security (RLS) in Power BI can restrict which rows users can see, together providing both column masking and row filtering. Option A is incorrect because auditing and Defender for Cloud do not mask data. Option B is incorrect because Purview data map and catalog are for data discovery and governance, not masking. Option D is incorrect because sensitivity labels and auto-labeling are for classification, not data masking.

Answer

Azure SQL Database auditing and Microsoft Defender for Cloud

Answer

Microsoft Purview Data Map and data catalog

Answer

Microsoft Purview sensitivity labels and auto-labeling

Question 9

Your company uses Microsoft Intune to manage mobile devices. You need to ensure that corporate data in Microsoft 365 apps cannot be copied to personal apps on the same device. What should you configure?

Accepted Answer

App protection policy (MAM) with 'Restrict cut, copy, and paste'. App Protection Policies (MAM) allow you to restrict cut, copy, and paste operations between managed and unmanaged apps, preventing corporate data from being copied to personal apps. Option B is incorrect because Conditional Access policies control access to resources based on device compliance, but do not restrict data transfer at the app level. Option C is incorrect because device configuration profiles manage device settings, not app-level data movement. Option D is incorrect because device compliance policies enforce device health requirements, not app restrictions.

Answer

Conditional Access policy requiring compliant device

Answer

Device configuration profile with restrictions

Answer

Device compliance policy for mobile devices

Question 10

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft 365. You need to create a DLP policy that detects and blocks sharing of credit card numbers in Exchange Online emails. Which TWO components must you configure?

Accepted Answer

Action to block sharing. To detect and block sharing of credit card numbers in Exchange Online, you need to configure a sensitive info type for credit card numbers (Option D) to identify the data, and an action to block sharing (Option C) to enforce the policy. Option A is incorrect because retention labels are for retention policies, not DLP. Option B is incorrect because auto-labeling policies are used for applying labels, not for DLP. Option E is incorrect because trainable classifiers are for complex or custom patterns, but credit card numbers are predefined sensitive info types.

Answer

Retention label for financial data

Answer

Auto-labeling policy

Answer

Trainable classifier for credit card numbers

Question 11

A company is designing a solution to protect Azure Functions that process sensitive data. They need to ensure that only authenticated and authorized callers can invoke the function, and that secrets are not hard-coded. Which THREE actions should they take?

Accepted Answer

Use managed identity to access Azure Key Vault for secrets. Using a managed identity allows the function app to securely access Azure Key Vault to retrieve secrets without storing them in code or configuration. Option D is correct because enabling Azure AD authentication ensures that only authenticated callers (with valid Azure AD tokens) can invoke the function. Option E is correct because setting the authorization level to 'Function' or 'Admin' requires a function-specific or master key, respectively, providing an additional layer of authentication. Option A is incorrect because storing connection strings in application settings still exposes secrets in the app's configuration, and it does not enforce caller authentication. Option B is incorrect because requiring client certificates is not a standard mechanism for authenticating callers of Azure Functions; Azure AD authentication and function authorization keys are the recommended approaches.

Answer

Store connection strings in application settings

Answer

Require client certificates

Question 12

Your organization wants to enable Microsoft Defender for Cloud Apps to monitor and control the use of Box and Dropbox. Which TWO steps must you perform?

Accepted Answer

Connect the app using an app connector. You must connect the app via an app connector to enable monitoring and control. Option D is correct because Conditional Access App Control provides session-level control over sanctioned apps. Option B is incorrect because adding apps to the unsanctioned list blocks them entirely, but the goal is to monitor and control usage. Option C is incorrect because Conditional Access App Control uses a reverse proxy, not a forward proxy. Option E is incorrect because a cloud discovery report identifies shadow IT, but Box and Dropbox are known apps that should be connected via app connectors first.

Answer

Add Box and Dropbox to the unsanctioned list

Answer

Deploy a forward proxy

Answer

Run a cloud discovery report

Question 13

You are reviewing a Conditional Access policy in Microsoft Entra ID. The policy is intended to block sign-ins from high-risk users. However, some high-risk users are still able to sign in. What is the most likely reason?

Accepted Answer

The policy is not enforced because user risk is not being evaluated (e.g., missing licenses or risk policy). Conditional Access policies that rely on user risk require the user risk to be evaluated first. If the organization does not have the necessary Microsoft Entra ID P2 licenses or if the user risk policy is not configured, user risk levels may not be calculated in real-time, causing the policy not to enforce. Option B is incorrect because the policy is intended to block sign-ins from high-risk users regardless of client app type. Option C is incorrect because report-only mode would log but not block, but the question states the policy is intended to block. Option D is incorrect because the policy does not need to include all locations; the issue is about user risk evaluation.

Answer

The policy does not include all client app types

Answer

The policy is set to report-only mode

Answer

The policy does not include all locations

Question 14

You have created a custom Azure RBAC role named 'Custom SQL DB Reader' as shown in the exhibit. You assign this role to a user. The user reports they cannot read data from an Azure SQL Database. What is the most likely cause?

Accepted Answer

The Azure SQL Database is not configured to support Azure AD authentication. Even though the custom role includes dataActions for reading data (e.g., Microsoft.Sql/servers/databases/data/read), these dataActions only take effect when the user authenticates via Azure AD and the Azure SQL Database is configured to support Azure AD authentication. Without that configuration, RBAC dataActions are ineffective, and the user cannot read data. Option B is incorrect because the role includes Microsoft.Sql/servers/databases/read for control plane access. Option C is incorrect because assignableScopes includes the subscription, which covers the resource group. Option D is incorrect because the role does include dataActions; the problem is the missing Azure AD authentication support on the database.

Answer

The role does not include 'Microsoft.Sql/servers/databases/read' action

Answer

The assignableScopes does not include the resource group

Answer

The role does not include any dataActions

Question 15

You are reviewing an ARM template snippet that creates a blob container. The security team requires that the container be accessible only via authorized Azure AD identities, not via anonymous access. Based on the exhibit, is the configuration correct?

Accepted Answer

Yes, the setting 'publicAccess': 'None' prevents anonymous access, and Azure AD authentication is available by default. Setting 'publicAccess' to 'None' prevents any anonymous access to the blob container, and Azure AD authentication is enabled by default for authorized identities. Option A is incorrect because the configuration is already correct; disabling shared key access is not required for Azure AD authentication to work. Option B is incorrect because setting 'publicAccess' to 'Blob' would actually allow anonymous access to blobs, which contradicts the security requirement. Option D is incorrect because Azure AD authentication is built-in and does not require additional firewall rules to restrict access to Azure AD users.

Answer

Yes, but you also need to disable shared key access

Answer

No, you need to set 'publicAccess' to 'Blob' to restrict access

Answer

No, you must also configure a firewall rule to restrict access to Azure AD users