SC-100 Design solutions that align with security best practices and priorities Practice Test 2 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID and plans to implement a Zero Trust security model. You need to ensure that all access requests to corporate applications are continuously evaluated based on user risk, device compliance, and location. Which Microsoft Entra ID feature should you configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it enables real-time policy evaluation of access requests based on signals such as user risk (from Identity Protection), device compliance (via Microsoft Intune), and location (IP address ranges or named locations). This aligns directly with the Zero Trust principle of 'never trust, always verify' by continuously re-evaluating each access attempt rather than relying on static permissions.

Answer

Identity Governance

Answer

Privileged Identity Management (PIM)

Answer

Identity Protection

Question 2

Your enterprise uses Microsoft Defender for Cloud to secure a hybrid cloud environment spanning Azure and AWS. You need to design a solution that prioritizes remediation of the most critical vulnerabilities across both clouds based on Common Vulnerability Scoring System (CVSS) scores, exploitability, and business impact. Which Defender for Cloud feature should you use?

Accepted Answer

Security Explorer. Security Explorer (now part of Microsoft Defender for Cloud's Cloud Security Explorer) provides a graph-based query interface that allows you to identify and prioritize vulnerabilities across Azure and AWS based on CVSS scores, exploitability, and business impact. It enables you to filter by multiple dimensions (e.g., internet exposure, data sensitivity, attack path) to pinpoint the most critical risks, directly addressing the requirement to prioritize remediation across both clouds.

Answer

Regulatory Compliance Dashboard

Answer

Secure Score

Answer

Adaptive Application Controls

Question 3

Your organization is adopting Microsoft Purview to classify and protect sensitive data in Microsoft 365. You need to ensure that documents containing credit card numbers are automatically detected and encrypted when shared externally. What should you configure?

Accepted Answer

A sensitivity label configured with auto-labeling for credit card numbers and encryption for external sharing. Option B is correct because sensitivity labels in Microsoft Purview can be configured with auto-labeling conditions that detect sensitive data types (e.g., credit card numbers) and automatically apply encryption to documents when shared externally. This meets the requirement of automatic detection and encryption for external sharing without manual user intervention.

Answer

An Information Barrier policy between departments

Answer

A retention label that deletes documents with credit card numbers after 90 days

Answer

A Data Loss Prevention (DLP) policy that blocks sharing of credit card numbers

Question 4

Your company is deploying Microsoft Defender XDR and wants to use automated investigation and response (AIR) to remediate confirmed threats. However, you need to ensure that high-impact actions like deleting email messages or isolating devices require manual approval from the security operations team. Which configuration should you set?

Accepted Answer

Set the automation level to 'Semi - require approval for high-severity remediations'. Option B is correct because the 'Semi - require approval for high-severity remediations' automation level in Microsoft Defender XDR ensures that high-impact actions (e.g., deleting email messages or isolating devices) require manual approval from the security operations team before execution. This setting balances automated efficiency with human oversight, specifically targeting high-severity threats while allowing lower-severity actions to proceed automatically.

Answer

Set the automation level to 'Full - automatically remediate all threats'

Answer

Set the automation level to 'No automated remediation'

Answer

Create a custom automation rule in Microsoft Sentinel

Question 5

Your organization is migrating on-premises applications to Azure and needs to secure secrets (database connection strings, API keys) used by these applications. You are required to rotate secrets automatically without downtime. Which Azure service should you use?

Accepted Answer

Azure Key Vault with managed identity and certificate auto-rotation. Azure Key Vault with managed identity and automatic rotation is the correct solution because Key Vault stores secrets securely, managed identity eliminates hard-coded credentials, and Key Vault can rotate certificates automatically. Option B (Azure App Configuration) is for configuration management, not secrets. Option C (Microsoft Purview) is for data governance. Option D (Azure AD Application Proxy) is for remote access to on-prem apps.

Answer

Microsoft Purview Information Protection

Answer

Azure App Configuration with feature flags

Answer

Azure AD Application Proxy

Question 6

Your company uses Microsoft Sentinel for security information and event management (SIEM). You need to design a solution that reduces alert fatigue by correlating low-fidelity alerts from multiple sources into a single high-fidelity incident. Which Microsoft Sentinel feature should you use?

Accepted Answer

Analytics rules with alert grouping enabled. Analytics rules with alert grouping enabled allow you to configure a rule that correlates multiple low-fidelity alerts (e.g., from different data sources or detection types) into a single high-fidelity incident. When alert grouping is enabled, the rule groups alerts that occur within a specified time window and share common entities (such as IP addresses or user accounts), reducing alert fatigue by presenting one consolidated incident instead of many individual alerts.

Answer

Workbooks

Answer

Playbooks

Answer

Hunting queries

Question 7

Your organization uses Microsoft Intune to manage mobile devices. You need to design a policy that ensures corporate data on personally owned devices is protected, but does not allow IT to wipe the entire device if it is lost or stolen. Which Intune policy type should you configure?

Accepted Answer

App Protection Policies (MAM) without device enrollment. App Protection Policies (MAM) without device enrollment is correct because they protect corporate data at the app level and allow selective wipe of corporate data only. Option A (Device compliance policies) enforce device-level settings. Option C (Device configuration profiles) configure device settings. Option D (Conditional Access policies) require device compliance but don't protect data selectively.

Answer

Conditional Access policies requiring device compliance

Answer

Device configuration profiles

Answer

Device compliance policies

Question 8

Your company is implementing Microsoft Copilot for Security to assist the security operations team. You need to ensure that prompts and responses from Copilot do not expose sensitive internal information to unauthorized users. Which configuration should you apply?

Accepted Answer

Enable RBAC and data boundary controls in Copilot for Security settings. Enabling role-based access control (RBAC) and data boundary controls in Copilot for Security settings is correct because it restricts access to prompts and responses based on user roles and ensures data stays within your tenant. Option B (Disable Copilot for Security for all users) would block the feature entirely. Option C (Use a third-party AI gateway) is unnecessary. Option D (Train users to avoid sensitive data) is not a technical control.

Answer

Use a third-party AI gateway to sanitize prompts

Answer

Disable Copilot for Security for all users

Answer

Train users to avoid entering sensitive information in prompts

Question 9

Your organization needs to audit all changes to Azure resources, including who made the change and what was changed. Which Azure service should you use to collect and analyze this audit data?

Accepted Answer

Azure Monitor with activity logs. Azure Monitor with activity logs is the correct service because it captures all control-plane operations on Azure resources, including who performed the change (via Azure Active Directory authentication), what was changed (the resource and properties), and when it occurred. Activity logs are retained for 90 days by default and can be exported to Log Analytics workspaces for advanced querying and alerting, making them the native audit trail for Azure resource modifications.

Answer

Azure Policy

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Question 10

Your organization is designing a security strategy for Microsoft 365 Copilot. You need to ensure that Copilot does not generate responses based on sensitive data that users are not authorized to access. Which TWO configurations should you implement?

Accepted Answer

Implement Conditional Access policies to restrict Copilot access based on user, device, and location.. Conditional Access policies (C) are correct because they enforce access controls at the authentication layer, ensuring that only authorized users from compliant devices and trusted locations can interact with Copilot. Sensitivity labels (E) are correct because Microsoft 365 Copilot respects sensitivity labels on documents and emails, preventing it from generating responses that include content from labeled sensitive data unless the user has the appropriate permissions. Together, these two controls address both who can access Copilot and what data Copilot can use in its responses.

Answer

Set up Information Barriers to prevent Copilot from accessing data across departments.

Answer

Configure Data Loss Prevention (DLP) policies to block sensitive data from being used in prompts.

Answer

Enable Purview Audit to monitor Copilot interactions.

Question 11

Your organization uses Microsoft Defender for Cloud to protect a multi-cloud environment (Azure, AWS, GCP). You need to ensure that security configurations are assessed against industry benchmarks like CIS and PCI DSS. Which THREE actions should you take?

Accepted Answer

Enable the regulatory compliance dashboard in Defender for Cloud and select the desired standards (CIS, PCI DSS).. Option A is correct because the regulatory compliance dashboard in Microsoft Defender for Cloud allows you to add built-in standards such as CIS and PCI DSS. Once enabled, Defender for Cloud automatically assesses your multi-cloud resources against the selected benchmarks and provides a compliance score with detailed recommendations for remediation.

Answer

Deploy Azure Firewall in each cloud environment to filter traffic.

Answer

Deploy the Log Analytics agent to all VMs in the multi-cloud environment.

Question 12

Your company is using Microsoft Entra ID and wants to implement passwordless authentication to improve security. Which THREE authentication methods should you consider?

Accepted Answer

Microsoft Authenticator app with phone sign-in. Microsoft Authenticator app with phone sign-in is a passwordless authentication method because it uses a cryptographic key pair stored on the user's device to sign authentication requests, eliminating the need for a password. When the user approves a notification on their phone, the app signs a challenge from Microsoft Entra ID using the private key, and the service verifies it with the public key. This aligns with the passwordless goal by replacing the password with a possession-based factor (the phone) and a biometric or PIN gesture.

Answer

SMS one-time passcode

Answer

App passwords

Question 13

Refer to the exhibit. You are evaluating an Azure Policy definition that checks whether a web app redirects HTTP to HTTPS. The policy uses 'auditIfNotExists' effect. After assigning this policy to a subscription, you notice that a web app that does not redirect HTTP to HTTPS is marked as 'Healthy'. What is the most likely cause?

Accepted Answer

The custom assessment referenced in the policy does not exist in Microsoft Defender for Cloud.. The 'auditIfNotExists' effect in Azure Policy requires a linked assessment in Microsoft Defender for Cloud to evaluate the existence condition. If the custom assessment referenced in the policy does not exist in Defender for Cloud, the policy cannot detect the missing HTTP-to-HTTPS redirect, causing non-compliant resources to be incorrectly marked as 'Healthy'.

Answer

The policy assignment is scoped to a management group that does not include the web app's subscription.

Answer

The policy definition has a syntax error in the 'existenceCondition' field.

Answer

The web app is not running and therefore not assessed.

Question 14

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel that detects machines with more than two malware alerts in a day. The query returns no results even though you know there are machines with multiple malware alerts. What is the most likely reason?

Accepted Answer

The alert name in the environment is not exactly 'Malware detected'; it might include a suffix like 'on endpoint'.. Option D is correct because the KQL query likely uses a hardcoded string 'Malware detected' in a where clause to filter alerts. If the actual alert names in the environment include a suffix like 'on endpoint' (e.g., 'Malware detected on endpoint'), the exact string match fails, causing the query to return no results. This is a common issue when alert naming conventions vary across Microsoft Defender for Endpoint or other data sources ingested into Sentinel.

Answer

The 'summarize' function is incorrectly used and creates duplicate counts.

Answer

The query filters out alerts with severity less than 'High'.

Answer

The query does not include a time range filter, so it returns data from all time.

Question 15

Refer to the exhibit. You are reviewing an ARM template that deploys a network security group (NSG) for a web application. The NSG allows inbound HTTP traffic from any source and then denies all other inbound traffic. However, after deployment, you find that HTTP traffic is being blocked. What is the most likely cause?

Accepted Answer

The NSG is not associated with the subnet or network interface where the web server is deployed.. Option B is correct because an NSG only filters traffic when it is associated with a subnet or a network interface card (NIC). Without association, the NSG rules are never applied, so the web server's HTTP traffic is not affected by the AllowHTTP rule and is instead subject to the default platform behavior, which allows all inbound traffic. Since the question states HTTP traffic is being blocked, the most likely cause is that the NSG is not associated with the subnet or NIC, leaving the web server's traffic ungoverned by the intended rules.

Answer

The AllowHTTP rule uses sourcePortRange '*' which conflicts with the DenyAll rule.

Answer

The DenyAll rule has a higher priority than the AllowHTTP rule, so it takes precedence.

Answer

The DenyAll rule uses protocol '*' which blocks all traffic including HTTP.