SC-100 Design solutions that align with security best practices and priorities Practice Test 12 — 15 Questions

Question 1

Your organization is a small business with 50 employees that uses Microsoft 365 Business Premium. You need to design a security baseline that protects against common threats like phishing, ransomware, and data leakage. The solution must be easy to manage and require minimal ongoing effort. You have the following requirements: 1. Block malicious emails and links. 2. Protect sensitive data from being shared externally. 3. Require multi-factor authentication for all users. 4. Keep devices healthy. Which combination of policies should you implement?

Accepted Answer

Enable Microsoft Defender for Office 365 Safe Links and Safe Attachments. Create a Microsoft Purview DLP policy to prevent external sharing of sensitive data. Create a Conditional Access policy to require MFA and device compliance.. Option C is correct because it directly addresses all four requirements: Microsoft Defender for Office 365 Safe Links and Safe Attachments blocks malicious emails and links; a Microsoft Purview DLP policy prevents external sharing of sensitive data, protecting against data leakage; a Conditional Access policy requiring MFA and device compliance enforces multi-factor authentication for all users and ensures devices are healthy. This combination is easy to manage with minimal ongoing effort, as it leverages built-in Microsoft 365 Business Premium capabilities without complex custom configurations.

Answer

Enable Microsoft Defender for Office 365 for phishing protection. Use Microsoft Purview Information Protection to automatically label sensitive emails. Create a Conditional Access policy to require MFA for admins only. Use Azure Information Protection scanner.

Answer

Enable Exchange Online Protection (EOP) for spam and malware filtering. Create a Conditional Access policy to require MFA for all users. Enable device compliance policies in Microsoft Intune.

Answer

Enable Microsoft Defender for Office 365 Safe Links and Safe Attachments. Create a Microsoft Purview DLP policy to block sharing of credit card numbers. Enable security defaults in Microsoft Entra ID to enforce MFA.

Question 2

Your organization is designing a security strategy for Microsoft 365. You need to align with Microsoft's Zero Trust best practices. Which TWO principles should be included?

Accepted Answer

Verify explicitly. The Zero Trust model, as defined by Microsoft, is built on three foundational principles: verify explicitly, use least privilege, and assume breach. 'Verify explicitly' means always authenticating and authorizing based on all available data points, including user identity, location, device health, service or workload, data classification, and anomalies, before granting access. This aligns directly with Microsoft's implementation in Azure AD Conditional Access, which enforces real-time policy evaluation for every access request.

Answer

Trust but verify

Answer

Verify implicitly

Answer

Use least privilege

Question 3

You are planning a security baseline for Azure resources using Microsoft Defender for Cloud. Which THREE recommendations are part of the Azure Security Benchmark?

Accepted Answer

Implement role-based access control (RBAC) for resource management. Option A is correct because the Azure Security Benchmark (ASB) includes identity and access control recommendations, specifically recommending role-based access control (RBAC) to manage resource access. RBAC is a foundational security control that enforces the principle of least privilege, and it is explicitly listed in the ASB under the Identity Management (IM) control family.

Answer

Disable TLS 1.0 and enable TLS 1.2

Answer

Use Point-to-Site VPN for remote access

Question 4

You are designing a Microsoft Purview data security solution for a multinational organization subject to GDPR and CCPA. Which THREE Purview capabilities should you include to meet regulatory requirements?

Accepted Answer

Data Loss Prevention (DLP) policies. Data Loss Prevention (DLP) policies are correct because they allow the organization to detect and prevent the accidental or intentional sharing of sensitive data—such as personally identifiable information (PII) covered under GDPR and CCPA—across email, SharePoint, OneDrive, and endpoints. By scanning content for sensitive information types (e.g., credit card numbers, EU passport numbers) and applying protective actions (e.g., blocking transmission, showing policy tips), DLP directly enforces data protection mandates required by these regulations.

Answer

Advanced eDiscovery

Answer

Data Lifecycle Management (retention policies)

Question 5

Contoso is a financial services company migrating critical workloads to Azure. They must comply with PCI DSS and have a Security Operations Center (SOC) team that uses Microsoft Sentinel. The CISO wants to ensure that the security posture aligns with Microsoft's cybersecurity reference architecture (MCRA). You need to design a solution that includes the following requirements: 1) All Azure subscriptions must be managed under a single management group hierarchy with consistent policies. 2) The SOC must have a centralized view of security alerts across all resources, including on-premises servers and multi-cloud environments. 3) Privileged access to Azure resources must be protected using just-in-time (JIT) access and Privileged Identity Management (PIM). 4) Compliance with PCI DSS must be continuously monitored and reported. 5) The solution must minimize operational overhead. What should you include in the design?

Accepted Answer

Deploy a single management group containing all subscriptions. Enable Microsoft Defender for Cloud with the 'PCI DSS v3.2.1' regulatory compliance dashboard on the management group. Configure Azure Policy to enforce security standards. Enable PIM and configure JIT VM access. Use Microsoft Sentinel as the SIEM, connecting it to Defender for Cloud and on-premises security sources.. Option A is correct because it provides a centralized management group structure for policy enforcement, uses Microsoft Defender for Cloud for continuous compliance monitoring and multicloud visibility, and integrates PIM and JIT for privileged access. Microsoft Sentinel can ingest alerts from Defender for Cloud. Option B is less effective because it lacks centralized policy management and uses separate Defender for Cloud instances. Option C is wrong because it relies on Azure Policy alone without the compliance monitoring and threat detection capabilities of Defender for Cloud. Option D is wrong because it bypasses policy enforcement at the management group level and uses manual processes.

Answer

Create separate management groups per business unit. Enable Microsoft Defender for Cloud on each subscription individually. Use Azure Policy to assign PCI DSS policies per subscription. Configure PIM at the tenant root management group. Use a third-party SIEM to aggregate alerts.

Answer

Deploy a management group hierarchy with policies inherited. Use Microsoft Defender for Cloud's secure score to monitor compliance manually. Implement PIM without JIT. Use Microsoft Sentinel but only for cloud workloads.

Answer

Use a single management group with Azure Policy to enforce PCI DSS controls. Rely on Azure Monitor for security alerts. Do not enable Defender for Cloud to reduce costs. Use PIM for privileged roles. Connect on-premises logs to a Log Analytics workspace for the SOC.

Question 6

Fabrikam is a healthcare organization that uses Microsoft 365 E5 and Azure. They have a hybrid identity environment with Active Directory on-premises synced to Microsoft Entra ID. The security team wants to implement a Zero Trust strategy following the 'verify explicitly' principle. They need to ensure that all access to Microsoft 365 services and Azure applications is conditionally enforced based on real-time risk signals. Additionally, they want to block legacy authentication protocols that do not support modern authentication. The solution must integrate with Microsoft Defender XDR and Microsoft Sentinel for threat intelligence. Which combination of technologies should you recommend?

Accepted Answer

Use Microsoft Entra Conditional Access policies with session controls from Microsoft Defender for Cloud Apps. Enable Microsoft Entra ID Protection to feed risk signals into Conditional Access. Block legacy authentication via a Conditional Access policy targeting 'Exchange Active Sync' and 'Other clients'. Integrate Microsoft Sentinel to ingest alerts from Defender XDR.. Option D is correct because it directly implements the 'verify explicitly' principle by using Microsoft Entra ID Protection to feed real-time risk signals into Conditional Access policies, which then enforce session controls via Microsoft Defender for Cloud Apps. It blocks legacy authentication through a targeted Conditional Access policy (not just disabling protocols in Exchange Online or at the firewall), and integrates Microsoft Sentinel to ingest alerts from Defender XDR for centralized threat intelligence. This combination ensures all access to Microsoft 365 and Azure applications is conditionally enforced based on dynamic risk, while also addressing the requirement to block legacy protocols that lack modern authentication support.

Answer

Implement Azure AD Identity Governance with access reviews. Use Conditional Access to require hybrid Azure AD joined devices. Block legacy authentication by disabling protocols in Exchange Online. Use Azure Sentinel without Defender XDR.

Answer

Use Azure AD B2B for external users only. Configure Conditional Access with MFA for all users. Use Azure AD Identity Protection for risk. Block legacy authentication at the firewall level.

Answer

Deploy Microsoft Intune for mobile device management and require compliant devices. Use Conditional Access to block legacy protocols. Rely on Azure ATP (now Microsoft Defender for Identity) for risk signals.

Question 7

A global retail company, Northwind Traders, is adopting a cloud-first strategy using Azure and Microsoft 365. They have a large number of temporary seasonal workers who need access to specific applications and data for limited periods. The security team wants to minimize the risk of standing privileges and ensure that access is granted only when needed and for a limited duration. They also need to audit all privileged access actions. The environment includes Microsoft Entra ID, Azure resources, and Microsoft 365 services. You need to design a privileged access strategy that follows the principle of least privilege and aligns with Microsoft's best practices for privileged identity management. What should you recommend?

Accepted Answer

Use Microsoft Entra Privileged Identity Management (PIM) to grant just-in-time access to Azure AD roles and Azure resources. Configure approval workflows for high-privilege roles. Set maximum activation durations. For non-Azure resources, use Privileged Access Groups (PAG) to manage access. Enable audit logging to a Log Analytics workspace for monitoring.. Option A is correct because it leverages Microsoft Entra Privileged Identity Management (PIM) to enforce just-in-time (JIT) access for Azure AD roles and Azure resources, aligning with the principle of least privilege and minimizing standing privileges. It includes approval workflows for high-privilege roles, maximum activation durations to limit exposure, and Privileged Access Groups (PAG) to manage access to non-Azure resources like Microsoft 365 workloads. Audit logging to a Log Analytics workspace provides comprehensive monitoring of all privileged actions, meeting the auditing requirement.

Answer

Create a custom role in Azure AD with limited permissions. Assign the role to a security group. Have users request access via a manual email process. The IT team approves and assigns the group membership temporarily.

Answer

Assign permanent roles to seasonal workers for the duration of their contract. Use Azure AD access reviews to periodically confirm access. Enable Azure AD audit logs. Use Conditional Access to require MFA for privileged roles.

Answer

Create separate Azure AD roles for each seasonal worker with granular permissions. Use Azure AD Identity Governance to automate access requests. Do not enable PIM to reduce complexity.

Question 8

Litware, a software development company, has adopted a DevOps culture and uses Azure DevOps for CI/CD pipelines. They deploy applications to Azure Kubernetes Service (AKS) and Azure App Services. The security team wants to ensure that secrets (API keys, connection strings) are not exposed in source code or pipeline logs. They also need to scan container images for vulnerabilities before deployment and ensure that only approved images are used in production. The solution must integrate with Microsoft Defender for Cloud and follow security best practices. What should you include in the design?

Accepted Answer

Store secrets in Azure Key Vault and use Azure DevOps Variable Groups linked to Key Vault for retrieval during pipelines. Enable Microsoft Defender for Containers on AKS to scan container images for vulnerabilities. Use Azure Policy (specifically Azure Policy for AKS with Gatekeeper) to enforce that only images from approved registries are deployed.. Option B is correct because it aligns with security best practices by using Azure Key Vault to securely store secrets and linking them to Azure DevOps Variable Groups for secure retrieval during pipelines, preventing exposure in source code or logs. It enables Microsoft Defender for Containers on AKS to scan container images for vulnerabilities before deployment, and uses Azure Policy with Gatekeeper to enforce that only images from approved registries are deployed, ensuring compliance and integration with Microsoft Defender for Cloud.

Answer

Use Azure App Configuration to store secrets with encryption. Run vulnerability scans using a third-party tool integrated into the pipeline. Create a custom script to check image registry location.

Answer

Store secrets as encrypted pipeline variables in Azure DevOps. Use Azure Container Registry (ACR) tasks to scan images. Implement manual approval gates in release pipelines to verify image source.

Answer

Store secrets in Azure Key Vault but use a custom task to retrieve them. Scan images using Microsoft Defender for Cloud after deployment. Use role-based access control to restrict registry access.

Question 9

Tailwind Traders is a small business that uses Microsoft 365 Business Premium. They have no dedicated IT staff. The owner wants to implement basic security measures to protect against common threats like phishing, ransomware, and unauthorized access. They need a simple, cost-effective solution that aligns with Microsoft's security best practices for small businesses. Which set of actions should you recommend?

Accepted Answer

Enable Security Defaults in Microsoft Entra ID to enforce MFA for all users. Configure Microsoft Defender for Office 365 to protect against phishing and malware. Use Microsoft Defender for Business (included) for endpoint protection. Regularly review the Microsoft 365 Secure Score and implement top recommendations.. Option D is correct because it aligns with Microsoft's security best practices for small businesses with no dedicated IT staff. Security Defaults in Microsoft Entra ID provide a baseline of MFA enforcement without requiring complex configuration. Microsoft Defender for Office 365 and Defender for Business (included in Microsoft 365 Business Premium) offer integrated phishing, malware, and endpoint protection. Regularly reviewing the Secure Score ensures continuous improvement against common threats like ransomware and unauthorized access.

Answer

Implement Privileged Identity Management (PIM) for all accounts. Use Azure Information Protection to classify all emails. Set up a SIEM using Microsoft Sentinel.

Answer

Deploy Microsoft Intune to manage devices. Configure Conditional Access policies to require compliant devices. Use Microsoft Defender for Endpoint for antivirus. Set up a VPN for remote access.

Answer

Purchase Azure AD Premium P2 for all users. Use Identity Protection to detect risks. Configure Conditional Access with session controls. Use Azure AD Identity Governance for access reviews.

Question 10

Proseware, a pharmaceutical company, is deploying a new AI-powered application using Azure OpenAI Service. The application will process sensitive research data and must comply with HIPAA. The security team wants to ensure that the data sent to the Azure OpenAI endpoint is not logged or stored by Microsoft, and that access to the service is restricted to authorized users with appropriate data classification. They also need to monitor for potential data exfiltration and prompt injection attacks. What should you recommend?

Accepted Answer

Provision Azure OpenAI Service with a 'data processing addendum' (DPA) to ensure no data is stored or logged. Configure Content Filtering to block sensitive data. Use Microsoft Purview Data Classification to label research data. Use Microsoft Defender for Cloud Apps (part of Defender XDR) to create a session policy that monitors and blocks data exfiltration attempts. Enable audit logging to Microsoft Sentinel for anomaly detection.. Option D is correct because it combines a Data Processing Addendum (DPA) to contractually prevent Microsoft from logging or storing data, Microsoft Purview Data Classification for labeling sensitive research data, and Microsoft Defender for Cloud Apps session policies to monitor and block data exfiltration. Additionally, enabling audit logging to Microsoft Sentinel provides anomaly detection for prompt injection attacks, fulfilling all HIPAA compliance and security requirements.

Answer

Use Azure OpenAI Service with default settings. Implement Microsoft Sentinel to detect threats. Use Azure Policy to enforce tagging of resources. Use Azure AD Conditional Access to require MFA for access.

Answer

Use Azure OpenAI Service with a private endpoint. Deploy Azure Information Protection to classify data. Use Azure Firewall to restrict access. Implement Azure DDoS Protection.

Answer

Use Azure OpenAI Service with managed identity. Configure Conditional Access to restrict access by IP. Use Azure Monitor to track usage. Implement Azure Key Vault for API keys.

Question 11

A multinational corporation, Contoso Ltd., is implementing Microsoft Purview to manage data governance across their Azure and Microsoft 365 environments. They need to discover sensitive data (e.g., credit card numbers, passport numbers) in Azure Blob Storage, Azure SQL Database, and SharePoint Online. The data must be classified and labeled automatically. Additionally, they want to prevent sensitive data from being shared externally via email and Teams. The solution should align with Microsoft's data security best practices. What should you recommend?

Accepted Answer

Deploy Microsoft Purview Data Map to scan Azure Blob Storage and Azure SQL Database. Create custom sensitivity labels to identify sensitive data types. Configure auto-labeling policies in Microsoft Purview to apply labels. Create Data Loss Prevention (DLP) policies in Microsoft Purview Compliance Portal to block external sharing of labeled content in email and Teams.. Option A is correct because Microsoft Purview Data Map can scan and classify data in Azure sources, and sensitivity labels can be applied automatically. DLP policies in Microsoft 365 (via Purview) can block external sharing. Option B is wrong because Azure Policy does not classify data. Option C is wrong because Azure Information Protection is deprecated. Option D is wrong because Defender for Cloud Apps is for cloud app security, not classification.

Answer

Use Azure Policy to enforce tagging on resources. Use Microsoft Defender for Cloud to identify sensitive data. Configure retention labels in Microsoft 365. Use Azure AD Conditional Access to block external sharing.

Answer

Use Microsoft Defender for Cloud Apps to discover sensitive data in cloud apps. Use Microsoft Purview Information Protection to label. Use Azure AD Identity Governance to manage access.

Answer

Use Azure Information Protection (AIP) to classify documents. Use Azure SQL Data Discovery & Classification for databases. Configure manual labeling rules. Use Microsoft 365 DLP policies.

Question 12

South Ridge School District uses Microsoft 365 Education and Azure for administrative systems. They have a large number of students and staff. The district wants to implement a security solution that protects against phishing attacks, ransomware, and inappropriate content. They also need to comply with the Children's Online Privacy Protection Act (COPPA) and other educational regulations. The solution should be cost-effective and easy to manage. What should you recommend?

Accepted Answer

Use Microsoft Defender for Office 365 to protect against phishing and malware. Deploy Microsoft Intune for Education to manage student devices and enforce security policies. Enable Microsoft Purview Communication Compliance to monitor for inappropriate content. Use Microsoft Entra ID (free tier) with Security Defaults for identity protection.. Option D is correct because it provides a cost-effective, education-focused security solution that directly addresses the district's requirements. Microsoft Defender for Office 365 protects against phishing and malware in email and collaboration tools, Microsoft Intune for Education enables policy enforcement and device management for students, Microsoft Purview Communication Compliance monitors for inappropriate content to meet COPPA and other regulations, and Microsoft Entra ID (free tier) with Security Defaults provides baseline identity protection without additional licensing costs.

Answer

Use Microsoft Sentinel to analyze security logs. Deploy Microsoft Defender for Endpoint on all devices. Use Azure Policy to enforce compliance. Implement third-party web filtering.

Answer

Upgrade to Microsoft 365 E5 for all users. Implement Azure AD Identity Protection and PIM. Use Microsoft Defender for Identity. Use Microsoft Sentinel for SIEM.

Answer

Use Microsoft 365 Business Premium for staff only. Use free Microsoft 365 Education for students. Implement Conditional Access policies. Use Microsoft Cloud App Security to block risky apps.

Question 13

Adventure Works is a startup that uses Microsoft 365 Business Premium. They have 20 employees and no cloud expertise. The CEO has been hearing about ransomware attacks on small businesses. They want to implement basic protection against ransomware using built-in Microsoft 365 features. They also want to ensure they can recover from an attack quickly. What should you recommend?

Accepted Answer

Enable Microsoft Defender for Office 365 to block malicious attachments and links. Configure Microsoft Defender for Business to enable controlled folder access and ransomware protection. Educate users on phishing. Use OneDrive Files Restore to recover from ransomware.. Option B is correct because it leverages built-in Microsoft 365 Business Premium features to provide immediate ransomware protection without requiring cloud expertise. Microsoft Defender for Office 365 blocks malicious attachments and links at the email gateway, while Defender for Business provides endpoint protection with controlled folder access. OneDrive Files Restore enables self-service recovery of files from ransomware within the last 30 days, aligning with the startup's need for quick recovery without additional infrastructure.

Answer

Purchase Azure Backup for all user devices. Configure backup policies to run daily. Use Microsoft Intune to enforce encryption. Implement Conditional Access to require MFA.

Answer

Use Microsoft Sentinel as a SIEM to detect ransomware patterns. Deploy Azure ATP for identity protection. Use Azure Policy to enforce backup.

Answer

Implement Azure Site Recovery for on-premises servers. Use Microsoft Defender for Cloud for threat detection. Deploy a third-party antivirus.

Question 14

Wide World Importers uses Azure Active Directory (now Microsoft Entra ID) and Microsoft 365. They have a hybrid identity with password hash sync. They want to implement a passwordless authentication strategy to improve security and user experience. They have a mix of Windows 10/11 devices and mobile devices (iOS/Android). They also have some shared computers in kiosk mode. The solution must support all user scenarios and align with Microsoft's authentication best practices. What should you recommend?

Accepted Answer

Implement Windows Hello for Business for Windows 10/11 devices. Deploy Microsoft Authenticator for mobile devices for passwordless sign-in. Use FIDO2 security keys for shared computers and kiosk scenarios. Enable combined registration for self-service password reset and Microsoft Authenticator.. Option A is correct because it covers all user scenarios: Windows Hello for Business for Windows devices, Microsoft Authenticator for mobile, and FIDO2 security keys for shared computers. Option B is wrong because SMS and OATH tokens are not passwordless (SMS is not truly passwordless). Option C is wrong because it relies on Microsoft Authenticator only, missing Windows devices. Option D is wrong because it excludes mobile devices.

Answer

Use SMS-based authentication for all users. Deploy OATH tokens for shared computers. Implement Azure AD Conditional Access to require passwordless for admins only.

Answer

Implement Windows Hello for Business for all Windows devices. Use smart cards for mobile devices. Use FIDO2 keys for shared computers.

Answer

Use the Microsoft Authenticator app for all users. Configure passwordless sign-in with the app. Use QR codes for kiosk computers.

Question 15

Contoso is a large enterprise with a complex Azure environment. They have multiple management groups, subscriptions, and a hub-spoke network topology. The security team wants to implement a consistent security baseline across all subscriptions using Azure Policy. They need to ensure that: 1) All resources must be deployed in approved regions only. 2) Network security groups must have specific rules to block high-risk ports. 3) All storage accounts must enforce HTTPS traffic. 4) The policies must be applied at the management group level to ensure inheritance. 5) Non-compliant resources must be automatically remediated where possible. What should you do?

Accepted Answer

Create custom Azure Policy definitions for the required configurations (allowed locations, NSG rule blocking ports, storage HTTPS). Assign the policies at the root management group. Enable 'deployIfNotExists' effect for automatic remediation of non-compliant resources. Use Azure Policy remediation tasks to fix existing non-compliant resources.. Option B is correct because it uses Azure Policy at the root management group to enforce inheritance across all subscriptions, with custom policy definitions for allowed locations, NSG rules blocking high-risk ports, and storage HTTPS. The 'deployIfNotExists' effect enables automatic remediation of non-compliant resources, and remediation tasks fix existing non-compliant resources, meeting all requirements without manual intervention.

Answer

Use Azure Policy Guest Configuration to enforce region and NSG rules. Assign policies at each subscription. Use Azure Automation runbooks for remediation.

Answer

Use Azure Blueprints to define the environment. Include Azure Policy assignments in the blueprint. Assign blueprint to each management group. Remediate manually.

Answer

Create a custom script using Azure PowerShell to check compliance daily. Use Azure Logic Apps to send alerts for non-compliance. Have IT staff manually fix issues.