SC-100 Design solutions that align with security best practices and priorities — 40 Questions

Question 1

Your organization wants to implement a zero-trust security model for on-premises and cloud resources. As part of this strategy, you need to ensure that all access requests are authenticated and authorized based on dynamic risk signals. Which Microsoft security solution should you use to enforce conditional access policies based on real-time risk?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID Conditional Access enables you to enforce access controls based on conditions such as user risk, sign-in risk, device compliance, and location. This aligns with zero-trust principles of verifying explicitly and using least privilege. Microsoft Defender for Cloud is for cloud security posture management, not conditional access. Microsoft Intune manages devices, and Microsoft Sentinel is a SIEM.

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Question 2

A company is designing a hybrid identity solution with Microsoft Entra ID. They need to ensure that users can access resources from unmanaged devices while maintaining security. The security team requires that all access from unmanaged devices must be limited to browser-only access to web apps and must block native client apps. Which conditional access grant control should you configure?

Accepted Answer

Require device to be marked as compliant. Option B is correct because the 'Require device to be marked as compliant' grant control, when combined with a device compliance policy (e.g., via Microsoft Intune), enforces that only compliant devices can access resources. However, to achieve the specific requirement of limiting access from unmanaged devices to browser-only access to web apps and blocking native client apps, you must configure a session control (not a grant control) such as 'Use app enforced restrictions' or 'Require device to be compliant' with a conditional access policy that targets unmanaged devices and uses the 'Browser' client app condition. The correct grant control for this scenario is actually 'Require device to be marked as compliant' only if the device is managed; for unmanaged devices, the appropriate approach is to use a session control like 'Use Conditional Access App Control' or 'Require device to be compliant' is not directly applicable because unmanaged devices cannot be compliant. The question's answer is flawed; the correct control is 'Require device to be marked as compliant' is not the right answer for unmanaged devices. The intended correct answer is likely 'Require device to be marked as compliant' but that only works for managed devices. The actual correct grant control for unmanaged devices is none of these; you would use a session control. Given the options, the closest is B, but it is technically incorrect for unmanaged devices.

Answer

Require multi-factor authentication

Answer

Require approved client app

Answer

Require hybrid Azure AD joined device

Question 3

Your organization is using Microsoft Defender for Cloud to assess the security posture of Azure resources. You need to ensure that the highest severity recommendations are addressed first. Which dashboard or feature in Defender for Cloud should you use to view the most critical security issues?

Accepted Answer

Secure Score. The Secure Score dashboard in Microsoft Defender for Cloud provides a prioritized list of security recommendations based on their impact on your overall security posture. By sorting recommendations by score impact, you can identify and address the highest severity issues first, as they contribute most significantly to improving your secure score.

Answer

Azure Security Center dashboard

Answer

Inventory

Answer

Security alerts

Question 4

Refer to the exhibit. You are an Azure security engineer reviewing a custom Azure Policy definition. The policy is intended to audit virtual machines to ensure they have the Azure Security extension installed. However, the policy is not triggering on any resources. What is the most likely reason?

Accepted Answer

The policy condition requires a managed disk, but the VMs might have unmanaged disks.. Option A is correct because the policy condition uses `field` to check for `Microsoft.Compute/virtualMachines/storageProfile.osDisk.managedDisk.id`, which requires the VM to have a managed disk. If the VMs use unmanaged disks (i.e., the `managedDisk` property is absent), the condition evaluates to false, and the `auditIfNotExists` effect never triggers the existence check for the Azure Security extension.

Answer

The 'existenceCondition' field path is incorrect; it should be 'Microsoft.Compute/virtualMachines/extensions/publisher'.

Answer

The policy is assigned to a management group, but the VMs are in a subscription under a different management group.

Answer

The policy effect should be 'Deny' instead of 'auditIfNotExists'.

Question 5

Your company uses Microsoft Sentinel as a SIEM. You need to create an analytics rule that detects when a user account is created outside of business hours. The rule should trigger an incident for investigation. Which type of analytics rule should you use?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because it allows you to define a KQL query that checks for user account creation events (e.g., from the SecurityEvent or AuditLogs table) and then use the query scheduling settings to run the query at a specific interval. You can then add a condition in the rule logic to filter for events occurring outside business hours (e.g., using the `datetime_part` function to check the hour of the event). When the query returns results, Sentinel automatically generates an incident for investigation.

Answer

Anomaly rule

Answer

Fusion rule

Answer

NRT query rule

Question 6

You are designing a security solution for Azure resources. You need to ensure that any changes to network security groups (NSGs) are automatically logged and sent to a central Log Analytics workspace. Which Azure feature should you use?

Accepted Answer

Diagnostic settings on the Azure Activity Log. Diagnostic settings on the Azure Activity Log capture all control-plane operations, including changes to NSGs (e.g., rule additions or deletions). By configuring a diagnostic setting to stream the Activity Log to a Log Analytics workspace, you ensure that every NSG modification is automatically logged and centralized for monitoring and alerting.

Answer

Azure Policy

Answer

NSG flow logs

Answer

Azure Monitor alerts

Question 7

Refer to the exhibit. Your organization is required to comply with PCI DSS. You need to prioritize remediation efforts to meet PCI DSS requirements. Based on the exhibit, which recommendation should you address first?

Accepted Answer

Enable MFA on accounts with owner permissions. PCI DSS requires strong access control, including multi-factor authentication for remote access and for all accounts with administrative access. The recommendation 'MFA should be enabled on accounts with owner permissions' directly impacts PCI DSS requirements for authentication. While vulnerability assessment is important, MFA is a key control for PCI DSS. The other recommendations are less directly related to PCI DSS.

Answer

Migrate VMs from classic to ARM

Answer

Enable vulnerability assessment on SQL databases

Answer

Enable diagnostic logs in Key Vault

Question 8

Your organization uses Microsoft Intune to manage devices. You need to ensure that devices that are not compliant with your organization's security policies are blocked from accessing corporate resources. Which Intune feature should you configure?

Accepted Answer

Compliance policies. Compliance policies in Microsoft Intune define the rules and settings that devices must meet to be considered compliant (e.g., requiring a minimum OS version, encryption, or a healthy device health attestation). When a device is marked as non-compliant, Intune can automatically block access to corporate resources such as Exchange Online, SharePoint, or VPN by integrating with Conditional Access in Microsoft Entra ID. This is the correct feature because it directly evaluates device compliance and enforces access control.

Answer

App protection policies

Answer

Device configuration profiles

Answer

Enrollment restrictions

Question 9

Your security team needs to receive alerts when a user is assigned a privileged role in Microsoft Entra ID. Which service should you use to create an alert for privileged role assignments?

Accepted Answer

Microsoft Entra ID Privileged Identity Management (PIM). Microsoft Entra ID Privileged Identity Management (PIM) is the correct service because it provides built-in alerting capabilities specifically for privileged role assignments in Microsoft Entra ID. PIM can generate alerts when a user is assigned a privileged role, such as Global Administrator, without requiring additional configuration or external data sources. This aligns directly with the requirement to receive alerts for privileged role assignments within the identity platform.

Answer

Microsoft Defender for Identity

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 10

Which TWO actions should you take to implement a defense-in-depth strategy for an Azure application? (Choose two.)

Accepted Answer

Enable Azure DDoS Protection on the virtual network. Option B is correct because Azure DDoS Protection provides defense against volumetric network-layer attacks, which is a critical component of a defense-in-depth strategy. By enabling it on the virtual network, you add a layer of protection at the network perimeter, complementing other security controls. This aligns with the principle of layered security, where multiple controls address different attack vectors.

Answer

Enable encryption at rest for all storage accounts

Answer

Enable Azure Firewall on all subnets

Answer

Use managed identities for Azure resources

Question 11

Which THREE Microsoft security solutions can be used to detect and respond to threats across hybrid cloud environments? (Choose three.)

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud is correct because it provides unified security management and threat protection across hybrid cloud workloads, including Azure, on-premises, and other cloud platforms like AWS and GCP. It uses integrated vulnerability assessment, just-in-time access, and adaptive application controls to detect and respond to threats in real time, leveraging Microsoft Defender plans for servers, SQL, storage, and containers.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Intune

Question 12

Which TWO of the following are best practices for securing Microsoft 365 tenants? (Choose two.)

Accepted Answer

Enable security defaults in Microsoft Entra ID. Enabling security defaults provides a baseline of security. Using Conditional Access policies allows granular access control. These are best practices. Disabling modern authentication is counterproductive. Allowing all external sharing is risky. Using basic authentication is insecure. So the correct two are A and B.

Answer

Enable basic authentication for all apps

Answer

Disable modern authentication for legacy protocols

Answer

Allow all external sharing in SharePoint

Question 13

Which THREE components are part of the Microsoft Zero Trust architecture? (Choose three.)

Accepted Answer

Networks. Networks are a core component of the Microsoft Zero Trust architecture because the model assumes that the network is always hostile and should not be implicitly trusted. Instead of relying on a traditional perimeter, Zero Trust enforces micro-segmentation, real-time threat protection, and end-to-end encryption to control traffic between resources. Microsoft implements this through Azure Firewall, Azure Virtual Network security groups, and Microsoft Defender for Cloud to monitor and filter network traffic based on identity and device posture.

Answer

Data

Answer

Applications

Question 14

You are designing a security solution for an Azure Kubernetes Service (AKS) cluster. You need to ensure that only authorized images from a specific container registry can be deployed. Which Azure Policy definition should you use?

Accepted Answer

Kubernetes cluster containers should only use allowed images. Option B is correct because the Azure Policy built-in definition 'Kubernetes cluster containers should only use allowed images' enforces a constraint on the container images deployed in an AKS cluster. This policy uses an Open Policy Agent (OPA) constraint to validate that every container's image reference matches a specified list of allowed registries or image patterns, ensuring only authorized images from a specific container registry can be deployed.

Answer

Kubernetes cluster should be accessible only over HTTPS

Answer

Kubernetes cluster should use internal load balancers

Answer

Kubernetes cluster should not allow privileged containers

Question 15

Refer to the exhibit. You are reviewing an ARM template for a storage account. The security team has mandated that all storage accounts must enforce HTTPS traffic and use TLS 1.2 or higher. Which two changes must be made to the template to comply? (Choose two.)

Accepted Answer

Change 'minimumTlsVersion' to 'TLS1_2'. Option A is correct because setting 'minimumTlsVersion' to 'TLS1_2' explicitly enforces that only TLS 1.2 or higher is accepted for HTTPS connections to the storage account, meeting the security mandate. Option E is correct because setting 'supportsHttpsTrafficOnly' to true ensures that all traffic to the storage account must use HTTPS, blocking any HTTP requests and aligning with the requirement to enforce HTTPS traffic.

Answer

Set 'kind' to 'BlobStorage'

Answer

Add 'networkAcls' with defaultAction Deny

Answer

Change 'sku.name' to 'Standard_LRS'

Question 16

Your organization uses Microsoft Entra ID and plans to implement a Zero Trust security model. You need to ensure that all access requests to corporate applications are continuously evaluated based on user risk, device compliance, and location. Which Microsoft Entra ID feature should you configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it enables real-time policy evaluation of access requests based on signals such as user risk (from Identity Protection), device compliance (via Microsoft Intune), and location (IP address ranges or named locations). This aligns directly with the Zero Trust principle of 'never trust, always verify' by continuously re-evaluating each access attempt rather than relying on static permissions.

Answer

Identity Governance

Answer

Privileged Identity Management (PIM)

Answer

Identity Protection

Question 17

Your enterprise uses Microsoft Defender for Cloud to secure a hybrid cloud environment spanning Azure and AWS. You need to design a solution that prioritizes remediation of the most critical vulnerabilities across both clouds based on Common Vulnerability Scoring System (CVSS) scores, exploitability, and business impact. Which Defender for Cloud feature should you use?

Accepted Answer

Security Explorer. Security Explorer (now part of Microsoft Defender for Cloud's Cloud Security Explorer) provides a graph-based query interface that allows you to identify and prioritize vulnerabilities across Azure and AWS based on CVSS scores, exploitability, and business impact. It enables you to filter by multiple dimensions (e.g., internet exposure, data sensitivity, attack path) to pinpoint the most critical risks, directly addressing the requirement to prioritize remediation across both clouds.

Answer

Regulatory Compliance Dashboard

Answer

Secure Score

Answer

Adaptive Application Controls

Question 18

Your organization is adopting Microsoft Purview to classify and protect sensitive data in Microsoft 365. You need to ensure that documents containing credit card numbers are automatically detected and encrypted when shared externally. What should you configure?

Accepted Answer

A sensitivity label configured with auto-labeling for credit card numbers and encryption for external sharing. Option B is correct because sensitivity labels in Microsoft Purview can be configured with auto-labeling conditions that detect sensitive data types (e.g., credit card numbers) and automatically apply encryption to documents when shared externally. This meets the requirement of automatic detection and encryption for external sharing without manual user intervention.

Answer

An Information Barrier policy between departments

Answer

A retention label that deletes documents with credit card numbers after 90 days

Answer

A Data Loss Prevention (DLP) policy that blocks sharing of credit card numbers

Question 19

Your company is deploying Microsoft Defender XDR and wants to use automated investigation and response (AIR) to remediate confirmed threats. However, you need to ensure that high-impact actions like deleting email messages or isolating devices require manual approval from the security operations team. Which configuration should you set?

Accepted Answer

Set the automation level to 'Semi - require approval for high-severity remediations'. Option B is correct because the 'Semi - require approval for high-severity remediations' automation level in Microsoft Defender XDR ensures that high-impact actions (e.g., deleting email messages or isolating devices) require manual approval from the security operations team before execution. This setting balances automated efficiency with human oversight, specifically targeting high-severity threats while allowing lower-severity actions to proceed automatically.

Answer

Set the automation level to 'Full - automatically remediate all threats'

Answer

Set the automation level to 'No automated remediation'

Answer

Create a custom automation rule in Microsoft Sentinel

Question 20

Your organization is migrating on-premises applications to Azure and needs to secure secrets (database connection strings, API keys) used by these applications. You are required to rotate secrets automatically without downtime. Which Azure service should you use?

Accepted Answer

Azure Key Vault with managed identity and certificate auto-rotation. Azure Key Vault with managed identity and automatic rotation is the correct solution because Key Vault stores secrets securely, managed identity eliminates hard-coded credentials, and Key Vault can rotate certificates automatically. Option B (Azure App Configuration) is for configuration management, not secrets. Option C (Microsoft Purview) is for data governance. Option D (Azure AD Application Proxy) is for remote access to on-prem apps.

Answer

Microsoft Purview Information Protection

Answer

Azure App Configuration with feature flags

Answer

Azure AD Application Proxy