SC-100 Design solutions that align with security best practices and priorities — 25 Questions

Question 1

A company is designing a hybrid identity solution with Microsoft Entra ID. They need to ensure that users can access resources from unmanaged devices while maintaining security. The security team requires that all access from unmanaged devices must be limited to browser-only access to web apps and must block native client apps. Which conditional access grant control should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Require approved client app. The correct grant control is 'Require approved client app' (Option C). This allows you to restrict access to only approved client apps, such as browsers like Microsoft Edge, while blocking native client apps like Outlook or Teams on unmanaged devices. By approving a browser as a client app, you can ensure that all access from unmanaged devices is browser-only. Option A (MFA) does not block native apps; Option B (Require device to be marked as compliant) would block all unmanaged devices, violating the requirement to allow browser access; Option D (Require hybrid Azure AD joined device) also blocks unmanaged devices. Therefore, C is the correct choice.

Answer

Require multi-factor authentication

Answer

Require device to be marked as compliant

Answer

Require hybrid Azure AD joined device

Question 2

Your organization is using Microsoft Defender for Cloud to assess the security posture of Azure resources. You need to ensure that the highest severity recommendations are addressed first. Which dashboard or feature in Defender for Cloud should you use to view the most critical security issues?

Accepted Answer

Secure Score. The Secure Score dashboard in Microsoft Defender for Cloud provides a prioritized list of security recommendations based on their impact on your overall security posture. By sorting recommendations by score impact, you can identify and address the highest severity issues first, as they contribute most significantly to improving your secure score.

Answer

Azure Security Center dashboard

Answer

Inventory

Answer

Security alerts

Question 3

Your company uses Microsoft Sentinel as a SIEM. You need to create an analytics rule that detects when a user account is created outside of business hours. The rule should trigger an incident for investigation. Which type of analytics rule should you use?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because it allows you to define a KQL query that checks for user account creation events (e.g., from the SecurityEvent or AuditLogs table) and then use the query scheduling settings to run the query at a specific interval. You can then add a condition in the rule logic to filter for events occurring outside business hours (e.g., using the `datetime_part` function to check the hour of the event). When the query returns results, Sentinel automatically generates an incident for investigation.

Answer

Anomaly rule

Answer

Fusion rule

Answer

NRT query rule

Question 4

Refer to the exhibit. Your organization is required to comply with PCI DSS. You need to prioritize remediation efforts to meet PCI DSS requirements. Based on the exhibit, which recommendation should you address first?

Accepted Answer

Enable MFA on accounts with owner permissions. PCI DSS requires strong access control, including multi-factor authentication for remote access and for all accounts with administrative access. The recommendation 'MFA should be enabled on accounts with owner permissions' directly impacts PCI DSS requirements for authentication. While vulnerability assessment is important, MFA is a key control for PCI DSS. The other recommendations are less directly related to PCI DSS.

Answer

Migrate VMs from classic to ARM

Answer

Enable vulnerability assessment on SQL databases

Answer

Enable diagnostic logs in Key Vault

Question 5

Which TWO actions should you take to implement a defense-in-depth strategy for an Azure application? (Choose two.)

Accepted Answer

Enable Azure DDoS Protection on the virtual network. Azure DDoS Protection provides defense against volumetric network-layer attacks, which is a critical component of a defense-in-depth strategy. By enabling it on the virtual network, you add a layer of protection at the network perimeter, complementing other security controls. Option E is correct because network security groups (NSGs) act as a distributed firewall to filter traffic between subnets, providing an additional layer of network segmentation and access control. Together, DDoS Protection and NSGs address different network attack vectors, aligning with the principle of layered security where multiple controls address different attack vectors.

Answer

Enable encryption at rest for all storage accounts

Answer

Enable Azure Firewall on all subnets

Answer

Use managed identities for Azure resources

Question 6

Which THREE Microsoft security solutions can be used to detect and respond to threats across hybrid cloud environments? (Choose three.)

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud is correct because it provides unified security management and threat protection across hybrid cloud workloads, including Azure, on-premises, and other cloud platforms like AWS and GCP. It uses integrated vulnerability assessment, just-in-time access, and adaptive application controls to detect and respond to threats in real time, leveraging Microsoft Defender plans for servers, SQL, storage, and containers.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Intune

Question 7

Which TWO of the following are best practices for securing Microsoft 365 tenants? (Choose two.)

Accepted Answer

Enable security defaults in Microsoft Entra ID. Enabling security defaults provides a baseline of security. Using Conditional Access policies allows granular access control. These are best practices. Disabling modern authentication is counterproductive. Allowing all external sharing is risky. Using basic authentication is insecure. So the correct two are A and B.

Answer

Enable basic authentication for all apps

Answer

Disable modern authentication for legacy protocols

Answer

Allow all external sharing in SharePoint

Question 8

Which THREE components are part of the Microsoft Zero Trust architecture? (Choose three.)

Accepted Answer

Networks. Networks are a core component of the Microsoft Zero Trust architecture because the model assumes that the network is always hostile and should not be implicitly trusted. Instead of relying on a traditional perimeter, Zero Trust enforces micro-segmentation, real-time threat protection, and end-to-end encryption to control traffic between resources. Microsoft implements this through Azure Firewall, Azure Virtual Network security groups, and Microsoft Defender for Cloud to monitor and filter network traffic based on identity and device posture.

Answer

Data

Answer

Applications

Question 9

You are designing a security solution for an Azure Kubernetes Service (AKS) cluster. You need to ensure that only authorized images from a specific container registry can be deployed. Which Azure Policy definition should you use?

Accepted Answer

Kubernetes cluster containers should only use allowed images. The Azure Policy built-in definition 'Kubernetes cluster containers should only use allowed images' enforces a constraint on the container images deployed in an AKS cluster. This policy uses an Open Policy Agent (OPA) constraint to validate that every container's image reference matches a specified list of allowed registries or image patterns, ensuring only authorized images from a specific container registry can be deployed.

Answer

Kubernetes cluster should be accessible only over HTTPS

Answer

Kubernetes cluster should use internal load balancers

Answer

Kubernetes cluster should not allow privileged containers

Question 10

Refer to the exhibit. You are reviewing an ARM template for a storage account. The security team has mandated that all storage accounts must enforce HTTPS traffic and use TLS 1.2 or higher. Which two changes must be made to the template to comply? (Choose two.)

Accepted Answer

Change 'minimumTlsVersion' to 'TLS1_2'. Setting 'minimumTlsVersion' to 'TLS1_2' explicitly enforces that only TLS 1.2 or higher is accepted for HTTPS connections to the storage account, meeting the security mandate. Option E is correct because setting 'supportsHttpsTrafficOnly' to true ensures that all traffic to the storage account must use HTTPS, blocking any HTTP requests and aligning with the requirement to enforce HTTPS traffic.

Answer

Set 'kind' to 'BlobStorage'

Answer

Add 'networkAcls' with defaultAction Deny

Answer

Change 'sku.name' to 'Standard_LRS'

Question 11

Your enterprise uses Microsoft Defender for Cloud to secure a hybrid cloud environment spanning Azure and AWS. You need to design a solution that prioritizes remediation of the most critical vulnerabilities across both clouds based on Common Vulnerability Scoring System (CVSS) scores, exploitability, and business impact. Which Defender for Cloud feature should you use?

Accepted Answer

Security Explorer. Security Explorer (now part of Microsoft Defender for Cloud's Cloud Security Explorer) provides a graph-based query interface that allows you to identify and prioritize vulnerabilities across Azure and AWS based on CVSS scores, exploitability, and business impact. It enables you to filter by multiple dimensions (e.g., internet exposure, data sensitivity, attack path) to pinpoint the most critical risks, directly addressing the requirement to prioritize remediation across both clouds.

Answer

Regulatory Compliance Dashboard

Answer

Secure Score

Answer

Adaptive Application Controls

Question 12

Your organization is adopting Microsoft Purview to classify and protect sensitive data in Microsoft 365. You need to ensure that documents containing credit card numbers are automatically detected and encrypted when shared externally. What should you configure?

Accepted Answer

A sensitivity label configured with auto-labeling for credit card numbers and encryption for external sharing. Sensitivity labels in Microsoft Purview can be configured with auto-labeling conditions that detect sensitive data types (e.g., credit card numbers) and automatically apply encryption to documents when shared externally. This meets the requirement of automatic detection and encryption for external sharing without manual user intervention.

Answer

An Information Barrier policy between departments

Answer

A retention label that deletes documents with credit card numbers after 90 days

Answer

A Data Loss Prevention (DLP) policy that blocks sharing of credit card numbers

Question 13

Your company is deploying Microsoft Defender XDR and wants to use automated investigation and response (AIR) to remediate confirmed threats. However, you need to ensure that high-impact actions like deleting email messages or isolating devices require manual approval from the security operations team. Which configuration should you set?

Accepted Answer

Set the automation level to 'Semi - require approval for high-severity remediations'. The 'Semi - require approval for high-severity remediations' automation level in Microsoft Defender XDR ensures that high-impact actions (e.g., deleting email messages or isolating devices) require manual approval from the security operations team before execution. This setting balances automated efficiency with human oversight, specifically targeting high-severity threats while allowing lower-severity actions to proceed automatically.

Answer

Set the automation level to 'Full - automatically remediate all threats'

Answer

Set the automation level to 'No automated remediation'

Answer

Create a custom automation rule in Microsoft Sentinel

Question 14

Your company uses Microsoft Sentinel for security information and event management (SIEM). You need to design a solution that reduces alert fatigue by correlating low-fidelity alerts from multiple sources into a single high-fidelity incident. Which Microsoft Sentinel feature should you use?

Accepted Answer

Analytics rules with alert grouping enabled. Analytics rules with alert grouping enabled allow you to configure a rule that correlates multiple low-fidelity alerts (e.g., from different data sources or detection types) into a single high-fidelity incident. When alert grouping is enabled, the rule groups alerts that occur within a specified time window and share common entities (such as IP addresses or user accounts), reducing alert fatigue by presenting one consolidated incident instead of many individual alerts.

Answer

Workbooks

Answer

Playbooks

Answer

Hunting queries

Question 15

Your organization uses Microsoft Intune to manage mobile devices. You need to design a policy that ensures corporate data on personally owned devices is protected, but does not allow IT to wipe the entire device if it is lost or stolen. Which Intune policy type should you configure?

Accepted Answer

App Protection Policies (MAM) without device enrollment. App Protection Policies (MAM) without device enrollment is correct because they protect corporate data at the app level and allow selective wipe of corporate data only. Option A (Conditional Access policies requiring device compliance) require device compliance but don't protect data selectively. Option C (Device configuration profiles) configure device settings. Option D (Device compliance policies) enforce device-level settings.

Answer

Conditional Access policies requiring device compliance

Answer

Device configuration profiles

Answer

Device compliance policies

Question 16

Your company is implementing Microsoft Copilot for Security to assist the security operations team. You need to ensure that prompts and responses from Copilot do not expose sensitive internal information to unauthorized users. Which configuration should you apply?

Accepted Answer

Enable RBAC and data boundary controls in Copilot for Security settings. Enabling role-based access control (RBAC) and data boundary controls in Copilot for Security settings is correct because it restricts access to prompts and responses based on user roles and ensures data stays within your tenant. Option B (Use a third-party AI gateway to sanitize prompts) is unnecessary. Option C (Disable Copilot for Security for all users) would block the feature entirely. Option D (Train users to avoid sensitive data) is not a technical control.

Answer

Use a third-party AI gateway to sanitize prompts

Answer

Disable Copilot for Security for all users

Answer

Train users to avoid entering sensitive information in prompts

Question 17

Your organization is designing a security strategy for Microsoft 365 Copilot. You need to ensure that Copilot does not generate responses based on sensitive data that users are not authorized to access. Which TWO configurations should you implement?

Accepted Answer

Implement Conditional Access policies to restrict Copilot access based on user, device, and location.. Conditional Access policies (C) are correct because they enforce access controls at the authentication layer, ensuring that only authorized users from compliant devices and trusted locations can interact with Copilot. Sensitivity labels (E) are correct because Microsoft 365 Copilot respects sensitivity labels on documents and emails, preventing it from generating responses that include content from labeled sensitive data unless the user has the appropriate permissions. Together, these two controls address both who can access Copilot and what data Copilot can use in its responses.

Answer

Set up Information Barriers to prevent Copilot from accessing data across departments.

Answer

Configure Data Loss Prevention (DLP) policies to block sensitive data from being used in prompts.

Answer

Enable Purview Audit to monitor Copilot interactions.

Question 18

Your organization uses Microsoft Defender for Cloud to protect a multi-cloud environment (Azure, AWS, GCP). You need to ensure that security configurations are assessed against industry benchmarks like CIS and PCI DSS. Which THREE actions should you take?

Accepted Answer

Enable the regulatory compliance dashboard in Defender for Cloud and select the desired standards (CIS, PCI DSS).. The regulatory compliance dashboard in Microsoft Defender for Cloud allows you to add built-in standards such as CIS and PCI DSS. Once enabled, Defender for Cloud automatically assesses your multi-cloud resources against the selected benchmarks and provides a compliance score with detailed recommendations for remediation.

Option C is correct because Azure Policy can be used to enforce security configurations based on benchmark recommendations. By creating policy initiatives that map to CIS or PCI DSS controls, you can audit or enforce compliance across your Azure, AWS, and GCP resources via Defender for Cloud's integration.

Option D is correct because continuous export of assessment data to a Log Analytics workspace enables custom reporting and analysis. This allows you to build tailored dashboards, run advanced queries, and integrate with SIEM or other monitoring tools, extending the value of the compliance assessments.

Answer

Deploy Azure Firewall in each cloud environment to filter traffic.

Answer

Deploy the Log Analytics agent to all VMs in the multi-cloud environment.

Question 19

Your company is using Microsoft Entra ID and wants to implement passwordless authentication to improve security. Which THREE authentication methods should you consider?

Accepted Answer

Microsoft Authenticator app with phone sign-in. Microsoft Authenticator app with phone sign-in is a passwordless authentication method because it uses a cryptographic key pair stored on the user's device to sign authentication requests, eliminating the need for a password. When the user approves a notification on their phone, the app signs a challenge from Microsoft Entra ID using the private key, and the service verifies it with the public key. This aligns with the passwordless goal by replacing the password with a possession-based factor (the phone) and a biometric or PIN gesture.

Answer

SMS one-time passcode

Answer

App passwords

Question 20

Refer to the exhibit. You are evaluating an Azure Policy definition that checks whether a web app redirects HTTP to HTTPS. The policy uses 'auditIfNotExists' effect. After assigning this policy to a subscription, you notice that a web app that does not redirect HTTP to HTTPS is marked as 'Healthy'. What is the most likely cause?

Accepted Answer

The custom assessment referenced in the policy does not exist in Microsoft Defender for Cloud.. The 'auditIfNotExists' effect in Azure Policy requires a linked assessment in Microsoft Defender for Cloud to evaluate the existence condition. If the custom assessment referenced in the policy does not exist in Defender for Cloud, the policy cannot detect the missing HTTP-to-HTTPS redirect, causing non-compliant resources to be incorrectly marked as 'Healthy'.

Answer

The policy assignment is scoped to a management group that does not include the web app's subscription.

Answer

The policy definition has a syntax error in the 'existenceCondition' field.

Answer

The web app is not running and therefore not assessed.