SC-100 Design solutions that align with security best practices and priorities Practice Test 3 — 15 Questions

Question 1

Which TWO Microsoft services can be used to implement a cloud security posture management (CSPM) solution? (Select exactly two correct options.)

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (option B) is correct because its Secure Score, security recommendations, and regulatory compliance dashboards are the core CSPM capabilities in Azure and multicloud environments, continuously assessing misconfigurations and hardening posture. Microsoft Entra Permissions Management (option D) is correct because it provides cloud infrastructure entitlement management (CIEM), discovering, right-sizing, and remediating excessive permissions across Azure, AWS, and GCP, which is a key CSPM-adjacent posture capability. Microsoft Purview (option A) is a data governance, data mapping, and compliance service, not a posture assessment tool. Microsoft Intune (option C) is endpoint/device management (MDM/MAM) and does not assess cloud resource configurations. Microsoft Sentinel (option E) is a SIEM/SOAR platform for threat detection and response, not CSPM posture management.

Answer

Microsoft Purview

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Question 2

Your organization is migrating on-premises Active Directory to Microsoft Entra ID. You need to design a solution that aligns with the Zero Trust principle of 'verify explicitly'. Which approach should you recommend for user authentication?

Accepted Answer

Deploy passwordless authentication using FIDO2 security keys for all users. D is correct because FIDO2 security keys provide phishing-resistant, passwordless authentication using hardware-bound cryptographic keys. This aligns with Zero Trust 'verify explicitly' by ensuring each sign-in uses strong, multi-factor verification without shared secrets. While Windows Hello for Business also offers similar phishing-resistant properties, it is often paired with password recovery (as in option B), which undermines a strict passwordless strategy. FIDO2 keys, when deployed for all users, provide the most consistent and explicit method of verifying identity.

Answer

Deploy passwordless authentication using Microsoft Authenticator with phone sign-in for all users

Answer

Enable users to sign in with Windows Hello for Business and allow password recovery via self-service

Answer

Implement password hash synchronization and enforce MFA only for privileged users

Question 3

You are designing a security baseline for Azure resources that host a critical application. The application uses Azure SQL Database, Azure Storage, and Azure Key Vault. You need to ensure that all resources use managed identities for authentication and that no secrets are stored in code or configuration files. Which combination of controls should you include in the baseline?

Accepted Answer

Use system-assigned managed identities for all resources. Configure each resource to use the managed identity. Disable local authentication on Key Vault and Storage. Enable Azure AD-only authentication on SQL Database.. It fully uses system-assigned managed identities for authentication to SQL, Storage, and Key Vault, and disables alternative authentication methods (shared keys for Storage, local auth for Key Vault, SQL authentication for SQL Database). This ensures no secrets are stored in code or configuration files, as the application uses managed identity to obtain Microsoft Entra ID tokens.

Answer

Use user-assigned managed identities for all resources. Configure Key Vault access policies to allow the managed identity. Disable anonymous access to Storage.

Answer

Use system-assigned managed identities for all resources. Store connection strings in Key Vault secrets and configure SQL Database to use Azure AD authentication.

Answer

Use user-assigned managed identities for all resources. Create a service principal with a client secret for Key Vault access.

Question 4

Your organization is implementing a Zero Trust architecture for access to cloud applications. Which TWO of the following are core components of the Microsoft Zero Trust model?

Accepted Answer

Conditional Access policies that enforce access decisions based on user, device, location, and risk. Conditional Access (B) is a core component of the Microsoft Zero Trust model because it is the policy engine that evaluates signals such as user identity, device compliance, location, and sign-in risk to enforce access decisions at the point of authentication. Microsoft Entra ID (C) is also core, as it serves as the centralized identity provider performing authentication and authorization, which is the foundation of the 'verify explicitly' principle in Zero Trust. Together these two embody the control plane that validates every access request to cloud applications. Microsoft Purview DLP (A) is a data governance and protection tool rather than a core Zero Trust access component, Microsoft Intune (D) is an endpoint management solution that supplies device signals but is not itself a core Zero Trust pillar, and Microsoft Defender for Cloud (E) is a cloud security posture management tool, not a core Zero Trust access component.

Answer

Microsoft Purview Data Loss Prevention policies to protect sensitive data

Answer

Microsoft Intune for mobile device management and application management

Answer

Microsoft Defender for Cloud to assess the security posture of cloud workloads

Question 5

Your company is designing a secure access strategy for a SaaS application that supports SAML 2.0. You need to enforce phishing-resistant authentication. Which THREE of the following methods meet the requirement?

Accepted Answer

FIDO2 security keys. FIDO2 security keys (B) are phishing-resistant because they use public-key cryptography bound to the origin (WebAuthn), so credentials cannot be replayed on a look-alike site. Passkeys (FIDO2) stored on user devices (C) are also WebAuthn/FIDO2 credentials, offering the same origin-bound, phishing-resistant properties whether synced or device-bound. Certificate-based authentication (CBA) (D) is phishing-resistant because the private key never leaves the protected store and the TLS client authentication binds to the legitimate server, so a fake site cannot obtain a usable credential. Microsoft Authenticator push notifications (A) are not phishing-resistant because users can be tricked into approving a malicious MFA prompt (MFA fatigue), and SMS OTP (E) is vulnerable to interception, SIM swapping, and real-time phishing proxies.

Answer

Microsoft Authenticator push notifications

Answer

SMS one-time passcode (OTP)

Question 6

Your organization wants to implement a defense-in-depth strategy for Azure virtual machines. Which THREE of the following should you include?

Accepted Answer

Azure Disk Encryption for OS and data disks. Azure Disk Encryption (A) is correct because it encrypts the OS and data disks of Azure VMs using BitLocker (Windows) or dm-crypt (Linux), protecting data at rest as part of a defense-in-depth strategy. Microsoft Defender for Cloud with vulnerability assessment and just-in-time VM access (C) is correct because it provides threat protection, continuous security posture assessment, and reduces the attack surface by locking down management ports until needed. Network security groups (E) are correct because they filter inbound and outbound traffic at the subnet and NIC level using security rules, providing network-layer segmentation and access control. Azure Firewall (B) is not the best fit here because it is a managed network security service typically deployed at the virtual network or hub level, and the question focuses on VM-level defense-in-depth controls rather than a centralized firewall. Azure Bastion (D) is also not included because, while it offers secure RDP/SSH access without exposing public IPs, it is a connectivity service rather than a core defense-in-depth control for protecting the VMs themselves in this scenario.

Answer

Azure Firewall to inspect all traffic to the VMs

Answer

Azure Bastion to provide secure RDP and SSH access

Question 7

Your organization is deploying a new application on Azure that will process personal data for European Union residents. The compliance team requires that the application encrypts all data at rest and in transit, that access to the data is logged and auditable, and that the data is not stored outside the EU. You need to design a solution that meets these requirements while following security best practices. The solution must also minimize operational overhead. You have decided to use Azure SQL Database, Azure Storage, and Azure Key Vault. Which design should you recommend?

Accepted Answer

Use Azure SQL Database with Transparent Data Encryption (TDE) using service-managed keys. Enforce TLS 1.2 for connections. Use Azure Storage with encryption at rest using Microsoft-managed keys. Store keys in Azure Key Vault. Configure geo-redundant storage (GRS) in an EU region. Enable diagnostic settings to send logs to a Log Analytics workspace in the EU.. A correct design to meet all requirements with minimal operational overhead would use TDE with service-managed keys (no Key Vault needed), enforce TLS 1.2, use Azure Storage encryption with Microsoft-managed keys, configure geo-redundant storage within the EU, enable SQL Auditing, and stream audit logs via diagnostic settings to a Log Analytics workspace in the EU. Since the provided option D includes the Key Vault contradiction and omits explicit SQL Auditing, it is not fully correct.

Answer

Use Azure SQL Database with Always Encrypted using Azure Key Vault. Use Azure Storage with encryption at rest. Enforce TLS 1.2. Use Azure Traffic Manager to route traffic to EU regions. Enable SQL Auditing and export logs to an on-premises SIEM.

Answer

Use Azure SQL Database with Always Encrypted using client-managed keys stored in a config file. Enforce TLS 1.2. Use Azure Storage with client-side encryption. Store keys in Azure Key Vault. Configure LRS in EU. Enable SQL Auditing.

Answer

Use Azure SQL Database with SQL Server encryption (cell-level). Use Azure Storage with encryption at rest. Store keys in application code. Use Azure Backup for long-term retention. Enable auditing on SQL Database.

Question 8

Your organization is designing a security strategy for Microsoft 365. You need to align with Microsoft's Zero Trust best practices. Which TWO principles should be included?

Accepted Answer

Verify explicitly. Option A (Verify explicitly) is correct because Microsoft's Zero Trust model requires that every access request be authenticated and authorized based on all available data points, including user identity, device health, location, and risk signals, rather than granting access based on network location alone. Option D (Assume breach) is correct because Zero Trust mandates operating as if a breach has already occurred, which means minimizing blast radius, segmenting access, encrypting data, and using analytics and telemetry to detect and respond to threats proactively. Option E (Use least privilege) is correct because Zero Trust requires limiting user and workload access with just-in-time and just-enough-access (JIT/JEA) policies, risk-based adaptive policies, and data protection to prevent lateral movement and credential abuse. Option B (Trust but verify) is incorrect because it reflects a traditional perimeter-based security mindset rather than Zero Trust, which does not assume trust based on network location. Option C (Verify implicitly) is incorrect because Zero Trust explicitly rejects implicit trust and instead requires explicit verification of every access request.

Answer

Trust but verify

Answer

Verify implicitly

Question 9

You are planning a security baseline for Azure resources using Microsoft Defender for Cloud. Which THREE recommendations are part of the Azure Security Benchmark?

Accepted Answer

Implement role-based access control (RBAC) for resource management. Option A is correct because the Azure Security Benchmark (ASB) includes the Identity and Access Management control 'Use role-based access control (RBAC) to manage resource access,' which requires assigning built-in or custom roles to users, groups, and service principals at the appropriate scope instead of granting broad permissions. Option B is correct because the ASB's Identity Management control 'Require multi-factor authentication (MFA) for all privileged accounts' mandates MFA (via Microsoft Entra ID, Conditional Access, or PIM) for administrative and privileged roles to mitigate credential-theft attacks. Option C is correct because the ASB's Data Protection control 'Encrypt data in transit' requires enforcing modern TLS (TLS 1.2 or higher) and disabling weak protocols such as TLS 1.0/1.1 and SSL. Option D is not part of the ASB baseline recommendations; Point-to-Site VPN is a connectivity design choice, not a benchmark control, and the ASB instead addresses remote access through identity, MFA, and Conditional Access controls. Option E is not a distinct ASB recommendation in the form stated; the benchmark's network security controls focus on NSGs/ASGs and Azure Firewall as segmentation mechanisms, but the specific phrasing 'enable NSGs on subnets' is not one of the three benchmark recommendations listed here.

Answer

Use Point-to-Site VPN for remote access

Answer

Enable network security groups on subnets to restrict traffic

Question 10

Proseware, a pharmaceutical company, is deploying a new AI-powered application using Azure OpenAI Service. The application will process sensitive research data and must comply with HIPAA. The security team wants to ensure that the data sent to the Azure OpenAI endpoint is not logged or stored by Microsoft, and that access to the service is restricted to authorized users with appropriate data classification. They also need to monitor for potential data exfiltration and prompt injection attacks. What should you recommend?

Accepted Answer

Provision Azure OpenAI Service with a 'data processing addendum' (DPA) to ensure no data is stored or logged. Configure Content Filtering to block sensitive data. Use Microsoft Purview Data Classification to label research data. Use Microsoft Defender for Cloud Apps (part of Defender XDR) to create a session policy that monitors and blocks data exfiltration attempts. Enable audit logging to Microsoft Sentinel for anomaly detection.. To meet the requirements, the solution should include: (1) a DPA for HIPAA plus configuring Azure OpenAI for zero data retention/disable abuse monitoring to prevent data logging/storage; (2) Microsoft Purview Data Loss Prevention (DLP) to block sensitive data, not Content Filtering; (3) Microsoft Purview Data Classification for labeling; (4) Defender for Cloud Apps session policy for exfiltration monitoring; (5) audit logging to Sentinel for anomaly detection; and (6) network/access controls such as Private Endpoint and Conditional Access. No single option includes all necessary controls, but D is closest if corrected.

Answer

Use Azure OpenAI Service with default settings. Implement Microsoft Sentinel to detect threats. Use Azure Policy to enforce tagging of resources. Use Azure AD Conditional Access to require MFA for access.

Answer

Use Azure OpenAI Service with a private endpoint. Deploy Azure Information Protection to classify data. Use Azure Firewall to restrict access. Implement Azure DDoS Protection.

Answer

Use Azure OpenAI Service with managed identity. Configure Conditional Access to restrict access by IP. Use Azure Monitor to track usage. Implement Azure Key Vault for API keys.

Question 11

A multinational corporation, Contoso Ltd., is implementing Microsoft Purview to manage data governance across their Azure and Microsoft 365 environments. They need to discover sensitive data (e.g., credit card numbers, passport numbers) in Azure Blob Storage, Azure SQL Database, and SharePoint Online. The data must be classified and labeled automatically. Additionally, they want to prevent sensitive data from being shared externally via email and Teams. The solution should align with Microsoft's data security best practices. What should you recommend?

Accepted Answer

Deploy Microsoft Purview Data Map to scan Azure Blob Storage and Azure SQL Database. Create custom sensitivity labels to identify sensitive data types. Configure auto-labeling policies in Microsoft Purview to apply labels. Create Data Loss Prevention (DLP) policies in Microsoft Purview Compliance Portal to block external sharing of labeled content in email and Teams.. Option D is correct because Microsoft Purview Data Map is the service that scans and classifies data across Azure Blob Storage, Azure SQL Database, and other sources, while sensitivity labels with auto-labeling policies in Microsoft Purview automatically classify and label sensitive data, and DLP policies in the Microsoft Purview compliance portal can block external sharing of labeled content in Exchange Online email and Microsoft Teams. This combination directly satisfies the requirements for discovery, classification, labeling, and prevention of external sharing in alignment with Microsoft's data security best practices. Option A is wrong because Azure Policy and Defender for Cloud do not discover or classify sensitive data, and Conditional Access does not block external sharing of labeled content. Option B is wrong because Defender for Cloud Apps focuses on SaaS app discovery and governance rather than scanning Azure Blob Storage and Azure SQL Database, and Identity Governance manages access, not data classification or DLP. Option C is wrong because Azure Information Protection is deprecated in favor of Microsoft Purview Information Protection, Azure SQL Data Discovery & Classification is limited to SQL databases, and manual labeling does not meet the automatic labeling requirement.

Answer

Use Azure Policy to enforce tagging on resources. Use Microsoft Defender for Cloud to identify sensitive data. Configure retention labels in Microsoft 365. Use Azure AD Conditional Access to block external sharing.

Answer

Use Microsoft Defender for Cloud Apps to discover sensitive data in cloud apps. Use Microsoft Purview Information Protection to label. Use Azure AD Identity Governance to manage access.

Answer

Use Azure Information Protection (AIP) to classify documents. Use Azure SQL Data Discovery & Classification for databases. Configure manual labeling rules. Use Microsoft 365 DLP policies.

Question 12

South Ridge School District uses Microsoft 365 Education and Azure for administrative systems. They have a large number of students and staff. The district wants to implement a security solution that protects against phishing attacks, ransomware, and inappropriate content. They also need to comply with the Children's Online Privacy Protection Act (COPPA) and other educational regulations. The solution should be cost-effective and easy to manage. What should you recommend?

Accepted Answer

Use Microsoft Defender for Office 365 to protect against phishing and malware. Deploy Microsoft Intune for Education to manage student devices and enforce security policies. Enable Microsoft Purview Communication Compliance to monitor for inappropriate content. Use Microsoft Entra ID (free tier) with Security Defaults for identity protection.. It provides a cost-effective, education-focused security solution that directly addresses the district's requirements. Microsoft Defender for Office 365 protects against phishing and malware in email and collaboration tools, Microsoft Intune for Education enables policy enforcement and device management for students, Microsoft Purview Communication Compliance monitors for inappropriate content to meet COPPA and other regulations, and Microsoft Entra ID (free tier) with Security Defaults provides baseline identity protection without additional licensing costs.

Answer

Use Microsoft Sentinel to analyze security logs. Deploy Microsoft Defender for Endpoint on all devices. Use Azure Policy to enforce compliance. Implement third-party web filtering.

Answer

Upgrade to Microsoft 365 E5 for all users. Implement Azure AD Identity Protection and PIM. Use Microsoft Defender for Identity. Use Microsoft Sentinel for SIEM.

Answer

Use Microsoft 365 Business Premium for staff only. Use free Microsoft 365 Education for students. Implement Conditional Access policies. Use Microsoft Cloud App Security to block risky apps.

Question 13

Contoso has a Microsoft 365 E5 subscription and uses Microsoft Defender for Cloud Apps. The security team wants to govern how users share files in Microsoft SharePoint Online and Microsoft OneDrive for Business, including blocking external sharing of files that contain sensitive credit card data, while allowing internal collaboration. The solution must minimize administrative effort and integrate with existing Microsoft Purview sensitivity labels. What should you include in the design?

Accepted Answer

Configure a Microsoft Defender for Cloud Apps file policy that uses the sensitivity label as a filter condition and applies a governance action to block external sharing.. A Microsoft Defender for Cloud Apps file policy is the appropriate solution because it can inspect files in SharePoint Online and OneDrive for Business, use Microsoft Purview sensitivity labels as a filter, and apply governance actions such as blocking external sharing. This integrates with existing labeling and requires minimal administrative effort, directly satisfying the requirement to protect sensitive credit card data while allowing internal collaboration.

Answer

Configure Microsoft Defender for Office 365 safe attachments policies to scan files for credit card data and block external sharing.

Answer

Deploy Microsoft Purview Data Loss Prevention policies for SharePoint Online and OneDrive for Business that use sensitive information types and restrict external sharing.

Answer

Create a Microsoft Entra ID conditional access policy that requires compliant devices for users accessing SharePoint Online.

Question 14

You are a cybersecurity architect at Contoso Ltd. The company has 5,000 employees and uses Microsoft 365 E5. The CISO wants to measure the organization's exposure to identity-based attacks and track improvements over time. The security team already uses Microsoft Defender for Identity and Microsoft Defender for Cloud Apps. You need to recommend a solution that provides a single, prioritized score for identity security posture and actionable recommendations. What should you recommend?

Accepted Answer

Microsoft Secure Score in the Microsoft 365 Defender portal. Microsoft Secure Score in the Microsoft 365 Defender portal aggregates identity security recommendations from Microsoft Entra ID, Defender for Identity, and other services into a single score. It provides prioritized improvement actions that help organizations reduce identity risk over time, making it the correct choice for measuring and improving identity security posture.

Answer

Microsoft Defender for Cloud secure score

Answer

Microsoft Defender for Identity health issues page

Answer

Microsoft Entra ID Protection risk detections report

Question 15

You are a cybersecurity architect at Adventure Works. The company is adopting a Zero Trust security model and wants to implement the principle of 'assume breach.' As part of this initiative, you need to design a solution that minimizes lateral movement and provides detection and response capabilities for compromised identities and endpoints. The company uses Microsoft 365 E5 and Microsoft Defender for Endpoint. Which TWO actions should you include in your design? (Choose two.)

Accepted Answer

Implement microsegmentation for Azure virtual networks using network security groups and Azure Firewall.. Microsegmentation restricts lateral movement by limiting network access between workloads, and Microsoft Defender for Identity detects compromised identities and lateral movement attempts. Together, they address the 'assume breach' principle by containing attackers and providing detection and response for identity threats.

Answer

Deploy Microsoft Defender for Cloud Apps to discover shadow IT and enforce app governance.

Answer

Use Microsoft Entra ID Conditional Access to require MFA for all users.

Answer

Configure Microsoft Intune compliance policies to require disk encryption on all devices.