SC-100 Design solutions that align with security best practices and priorities Practice Test 11 — 15 Questions

Question 1

You are a security architect for a large enterprise that is migrating to Microsoft 365. The organization has 50,000 users across multiple regions. They have recently experienced a ransomware attack that encrypted files on SharePoint Online and OneDrive for Business. The security team wants to implement a comprehensive protection strategy. Requirements: 1. Automatically detect and block ransomware-like behavior in real-time. 2. Provide users with self-service recovery of files encrypted by ransomware. 3. Ensure that all files in SharePoint and OneDrive are scanned for malware upon upload. 4. Minimize administrative overhead. Which combination of Microsoft 365 security features should you recommend?

Accepted Answer

Enable Microsoft Defender for Office 365 to scan files on upload and use version history and recycle bin for recovery.. Option C is correct because Microsoft Defender for Office 365 provides real-time scanning of files uploaded to SharePoint and OneDrive, detecting and blocking known malware. Combined with version history and the recycle bin, users can self-recover files encrypted by ransomware without administrative intervention, satisfying all requirements with minimal overhead.

Answer

Use Microsoft Entra ID Protection to detect compromised accounts and automatically block access.

Answer

Enable Microsoft Endpoint DLP and configure file policies to block encrypted files.

Answer

Configure Microsoft Purview auto-labeling to apply a 'Ransomware' label and then block all labeled files.

Question 2

Your organization is migrating on-premises Active Directory to Microsoft Entra ID. You need to design a solution that aligns with the Zero Trust principle of 'verify explicitly'. Which approach should you recommend for user authentication?

Accepted Answer

Deploy passwordless authentication using FIDO2 security keys for all users. D is correct because FIDO2 security keys provide phishing-resistant, passwordless authentication that aligns with the Zero Trust 'verify explicitly' principle by requiring a hardware-bound cryptographic proof of identity at every sign-in. This eliminates reliance on shared secrets (passwords) and ensures that authentication is explicitly verified through a physical device, meeting the strictest security requirements for user authentication.

Answer

Deploy passwordless authentication using Microsoft Authenticator with phone sign-in for all users

Answer

Enable users to sign in with Windows Hello for Business and allow password recovery via self-service

Answer

Implement password hash synchronization and enforce MFA only for privileged users

Question 3

You are designing a security baseline for Azure resources that host a critical application. The application uses Azure SQL Database, Azure Storage, and Azure Key Vault. You need to ensure that all resources use managed identities for authentication and that no secrets are stored in code or configuration files. Which combination of controls should you include in the baseline?

Accepted Answer

Use system-assigned managed identities for all resources. Configure each resource to use the managed identity. Disable local authentication on Key Vault and Storage. Enable Azure AD-only authentication on SQL Database.. Option C is correct because it enforces the principle of using managed identities for authentication without storing any secrets. System-assigned managed identities are tied directly to each Azure resource, eliminating the need for credential management. Disabling local authentication on Key Vault and Storage, and enabling Azure AD-only authentication on SQL Database, ensures that only managed identities (or other Azure AD identities) can authenticate, meeting the requirement that no secrets are stored in code or configuration files.

Answer

Use user-assigned managed identities for all resources. Configure Key Vault access policies to allow the managed identity. Disable anonymous access to Storage.

Answer

Use system-assigned managed identities for all resources. Store connection strings in Key Vault secrets and configure SQL Database to use Azure AD authentication.

Answer

Use user-assigned managed identities for all resources. Create a service principal with a client secret for Key Vault access.

Question 4

You are designing a security operations strategy for Microsoft 365. You need to prioritize alerts from Microsoft Defender XDR based on their impact on business operations. Which security best practice should you follow?

Accepted Answer

Prioritize alerts based on a risk assessment that considers asset criticality, threat severity, and business impact. Option A is correct because Microsoft Defender XDR integrates with Microsoft 365 Defender's risk-based alert prioritization, which uses a combination of asset criticality (e.g., from Microsoft Purview or Defender for Cloud Apps), threat severity (e.g., from the Microsoft Defender portal's alert severity levels: Informational, Low, Medium, High), and business impact (e.g., via sensitivity labels or data classification). This aligns with the security best practice of risk-based alert triage, ensuring that high-impact alerts are addressed first to minimize business disruption.

Answer

Prioritize alerts based on a qualitative risk assessment only

Answer

Treat all alerts with equal severity to ensure none are missed

Answer

Prioritize alerts based solely on the MITRE ATT&CK technique involved

Question 5

Your company is implementing Microsoft Purview Information Protection to protect sensitive data. The compliance team requires that when a user applies a 'Highly Confidential' sensitivity label to a document, the document is automatically encrypted and watermarked. Which configuration should you use?

Accepted Answer

Configure the sensitivity label to apply encryption and dynamic watermarking. Publish the label to users.. Option A is correct because encryption and dynamic watermarking are built-in label settings. Option B is wrong because auto-labeling policies apply labels based on conditions, not user action. Option C is wrong because access policies control access but do not add watermarks. Option D is wrong because DLP policies apply actions like block, not encryption or watermarking.

Answer

Create a DLP policy that encrypts and watermarks the document when it is shared externally

Answer

Create an auto-labeling policy that detects sensitive content and applies the label automatically

Answer

Create a Conditional Access policy that requires the label to be applied to all documents

Question 6

You are designing a secure DevOps pipeline in GitHub that deploys to Azure Kubernetes Service (AKS). The security team requires that no secrets are stored in the pipeline variables and that all container images are scanned for vulnerabilities before deployment. Which approach aligns with security best practices?

Accepted Answer

Use GitHub Actions with OpenID Connect to authenticate to Azure without storing any secrets. Integrate Microsoft Defender for Containers to scan images in Azure Container Registry.. Option B is correct because it uses OpenID Connect (OIDC) to authenticate GitHub Actions to Azure without storing any long-lived secrets, which aligns with the requirement that no secrets be stored in pipeline variables. Additionally, integrating Microsoft Defender for Containers provides vulnerability scanning for container images in Azure Container Registry (ACR), meeting the image scanning requirement before deployment to AKS.

Answer

Use Azure DevOps with a service principal that has a client secret stored in Azure Key Vault. Use Trivy to scan images.

Answer

Use GitHub Actions with a managed identity for the GitHub runner. Disable image scanning to speed up deployments.

Answer

Use GitHub Actions with environment secrets for Azure service principal credentials. Use Docker Hub's vulnerability scanning.

Question 7

Your organization is migrating to Microsoft 365 and wants to implement a defense-in-depth strategy for email security. Which combination of Microsoft services should you use?

Accepted Answer

Microsoft Defender for Office 365 and Exchange Online Protection. Defense-in-depth for email security requires layered protection at the transport, filtering, and post-delivery stages. Exchange Online Protection (EOP) provides baseline anti-malware, anti-spam, and transport rules, while Microsoft Defender for Office 365 adds advanced threat protection like Safe Attachments, Safe Links, and anti-phishing policies that inspect URLs and attachments in real time. Together, they cover the full email threat chain from ingress to user interaction.

Answer

Microsoft Purview Compliance Manager and Microsoft Defender for Cloud Apps

Answer

Microsoft Intune and Microsoft Entra ID

Answer

Microsoft Sentinel and Microsoft Defender for Identity

Question 8

You are designing a security solution for a hybrid identity environment that uses Microsoft Entra ID and on-premises Active Directory. The company wants to enforce Zero Trust principles by continuously verifying user access. Which feature should you implement?

Accepted Answer

Implement Conditional Access policies that evaluate session risk in real time using continuous access evaluation. Option B is correct because session risk-based Conditional Access with continuous access evaluation (CAE) enables real-time risk assessment and enforcement. Option A is wrong because Azure AD Join is for devices, not continuous verification. Option C is wrong because Seamless SSO simplifies sign-on but does not enforce continuous verification. Option D is wrong because MFA registration does not provide continuous verification during sessions.

Answer

Implement Microsoft Entra Hybrid Join for all devices

Answer

Implement Microsoft Entra Seamless Single Sign-On

Answer

Implement Microsoft Entra ID Protection to require multi-factor authentication for all users

Question 9

Your organization uses Microsoft Sentinel as its SIEM. You need to design a solution to automatically respond to detected threats in Azure resources. The response must include isolating the affected virtual machine and creating a support ticket. Which approach should you use?

Accepted Answer

Create a Microsoft Sentinel automation rule that triggers a playbook when an incident is generated. The playbook uses Azure Logic Apps to isolate the VM and create a ticket in your IT service management tool.. Option C is correct because automation rules in Microsoft Sentinel can trigger playbooks (Logic Apps) to isolate VMs and create tickets. Option A is wrong because Azure Policy is for compliance, not incident response. Option B is wrong because Azure Automation runbooks lack the integration to create tickets directly. Option D is wrong because custom KQL queries only surface alerts, not automated response.

Answer

Create an Azure Policy initiative that automatically remediates non-compliant resources

Answer

Create a Microsoft Sentinel analytics rule that runs a KQL query and automatically sends an email to the security team

Answer

Create an Azure Automation runbook that runs on a schedule to check for threats and isolate VMs

Question 10

Your organization is implementing a Zero Trust architecture for access to cloud applications. Which TWO of the following are core components of the Microsoft Zero Trust model?

Accepted Answer

Conditional Access policies that enforce access decisions based on user, device, location, and risk. Option B is correct because Conditional Access policies are the core policy engine in Microsoft's Zero Trust model, enforcing access decisions dynamically based on signals such as user identity, device health, location, and real-time risk. This aligns with the Zero Trust principle of 'never trust, always verify' by continuously evaluating each access request.

Answer

Microsoft Purview Data Loss Prevention policies to protect sensitive data

Answer

Microsoft Intune for mobile device management and application management

Answer

Microsoft Defender for Cloud to assess the security posture of cloud workloads

Question 11

Your company is designing a secure access strategy for a SaaS application that supports SAML 2.0. You need to enforce phishing-resistant authentication. Which THREE of the following methods meet the requirement?

Accepted Answer

FIDO2 security keys. FIDO2 security keys (Option B) are phishing-resistant because they use public-key cryptography and are bound to a specific web origin, preventing credential reuse on fake sites. The WebAuthn protocol ensures the private key never leaves the device, and the hardware key provides strong multi-factor authentication that cannot be intercepted or relayed.

Answer

Microsoft Authenticator push notifications

Answer

SMS one-time passcode (OTP)

Question 12

Your organization wants to implement a defense-in-depth strategy for Azure virtual machines. Which THREE of the following should you include?

Accepted Answer

Azure Disk Encryption for OS and data disks. Azure Disk Encryption (ADE) uses BitLocker for Windows and DM-Crypt for Linux to encrypt OS and data disks at rest, protecting against unauthorized access to the physical disk. This is a foundational layer of defense-in-depth, ensuring that if an attacker gains access to the disk, the data remains unreadable without the encryption keys stored in Azure Key Vault.

Answer

Azure Firewall to inspect all traffic to the VMs

Answer

Azure Bastion to provide secure RDP and SSH access

Question 13

You are designing a solution to protect Microsoft 365 data from insider threats. Which TWO Microsoft Purview features should you use?

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management is correct because it is specifically designed to detect, investigate, and act on malicious and accidental insider risks by correlating signals from Microsoft 365 and Azure services, such as unusual file downloads or data exfiltration patterns. It uses predefined risk indicators and machine learning models to identify risky user activities that could lead to data breaches, making it a primary tool for protecting data from insider threats.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Audit (Premium)

Answer

Microsoft Purview eDiscovery (Premium)

Question 14

You are a security architect for a large multinational organization that uses Microsoft 365, Azure, and third-party SaaS applications. The organization has recently experienced a breach where an attacker compromised a user account via a phishing email and then used that account to access sensitive data in SharePoint Online and exfiltrate it via email. The security team wants to implement a comprehensive solution that aligns with the Zero Trust principles of 'verify explicitly', 'use least privilege', and 'assume breach'. You need to design a solution that includes identity protection, conditional access, data protection, and continuous monitoring. You have the following requirements: 1. Block phishing attacks in real time. 2. Enforce least privilege access to sensitive data. 3. Detect and respond to anomalous user behavior. 4. Protect data at rest and in transit. 5. Enable automated response to incidents. Which combination of Microsoft security services and configurations should you recommend?

Accepted Answer

Implement Microsoft Defender for Office 365 to block phishing emails. Use Conditional Access policies with session risk to enforce access controls. Deploy Microsoft Purview DLP and sensitivity labels to protect data. Use Microsoft Sentinel with automation rules and playbooks to detect and respond to incidents.. Option B is correct because it combines Microsoft Defender for Office 365 to block phishing, Conditional Access with risk policies to enforce least privilege, Microsoft Purview DLP and sensitivity labels to protect data, and Microsoft Sentinel with automation to detect and respond. Option A is wrong because it uses Azure AD (now Entra ID) Identity Protection but lacks DLP and monitoring. Option C is wrong because it does not include phishing prevention. Option D is wrong because it uses Microsoft Defender for Cloud Apps alone, which is insufficient for email and identity protection.

Answer

Implement Microsoft Defender for Cloud Apps to discover and control SaaS apps. Use Conditional Access with app control. Deploy Microsoft Purview Data Lifecycle Management. Use Azure Sentinel for monitoring.

Answer

Implement Microsoft Entra ID Protection to detect and block risky sign-ins. Use Conditional Access policies to require MFA and block legacy authentication. Use Microsoft Purview sensitivity labels to classify data and Azure Monitor to collect logs.

Answer

Implement Microsoft Defender for Identity to detect on-premises threats. Use Conditional Access with device compliance policies. Deploy Microsoft Purview Information Protection. Use Azure Security Center for monitoring.

Question 15

Your organization is deploying a new application on Azure that will process personal data for European Union residents. The compliance team requires that the application encrypts all data at rest and in transit, that access to the data is logged and auditable, and that the data is not stored outside the EU. You need to design a solution that meets these requirements while following security best practices. The solution must also minimize operational overhead. You have decided to use Azure SQL Database, Azure Storage, and Azure Key Vault. Which design should you recommend?

Accepted Answer

Use Azure SQL Database with Transparent Data Encryption (TDE) using service-managed keys. Enforce TLS 1.2 for connections. Use Azure Storage with encryption at rest using Microsoft-managed keys. Store keys in Azure Key Vault. Configure geo-redundant storage (GRS) in an EU region. Enable diagnostic settings to send logs to a Log Analytics workspace in the EU.. Option D is correct because it uses Transparent Data Encryption (TDE) with service-managed keys for Azure SQL Database, which encrypts data at rest with minimal operational overhead, and enforces TLS 1.2 for data in transit. Azure Storage encryption at rest with Microsoft-managed keys meets the encryption requirement without management burden. Geo-redundant storage (GRS) within an EU region ensures data residency, and diagnostic settings sending logs to a Log Analytics workspace in the EU provides auditable logging while keeping logs within the EU, all aligning with security best practices and minimizing operational overhead.

Answer

Use Azure SQL Database with Always Encrypted using Azure Key Vault. Use Azure Storage with encryption at rest. Enforce TLS 1.2. Use Azure Traffic Manager to route traffic to EU regions. Enable SQL Auditing and export logs to an on-premises SIEM.

Answer

Use Azure SQL Database with Always Encrypted using client-managed keys stored in a config file. Enforce TLS 1.2. Use Azure Storage with client-side encryption. Store keys in Azure Key Vault. Configure LRS in EU. Enable SQL Auditing.

Answer

Use Azure SQL Database with SQL Server encryption (cell-level). Use Azure Storage with encryption at rest. Store keys in application code. Use Azure Backup for long-term retention. Enable auditing on SQL Database.