SC-100 Design solutions that align with security best practices and priorities Practice Test 7 — 15 Questions

Question 1

A company uses Microsoft Intune to manage devices. They want to ensure that only devices that have passed health attestation can access corporate email. Which method should they use?

Accepted Answer

Create a device compliance policy for health attestation and use Conditional Access to require compliant devices. Option B is correct because it combines a device compliance policy that evaluates health attestation (e.g., BitLocker status, Secure Boot, code integrity) with a Conditional Access policy that grants access to corporate email only when the device is marked as compliant. This is the standard Microsoft approach for enforcing health attestation before granting access to cloud resources like Exchange Online.

Answer

Use Microsoft Defender for Endpoint to block devices that fail health attestation

Answer

Create an app protection policy to require device health attestation

Answer

Create a device configuration policy to enforce health attestation

Question 2

A security architect needs to design a solution that provides a unified view of security alerts from multiple clouds (Azure, AWS, GCP) and on-premises systems. The solution must also support automated response using playbooks. Which Microsoft service should they use?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution that ingests security alerts from multiple clouds (Azure, AWS, GCP) and on-premises systems via connectors. It supports automated response through playbooks built on Azure Logic Apps, enabling unified alert management and remediation workflows.

Answer

Microsoft Defender XDR

Answer

Microsoft Defender for Cloud

Answer

Microsoft Purview

Question 3

A company uses Azure DevOps and wants to implement a DevSecOps practice by scanning code for secrets and vulnerabilities before deployment. Which tool should they integrate into their pipeline?

Accepted Answer

Microsoft Defender for DevOps. Option A is correct because Microsoft Defender for DevOps (now part of Microsoft Defender for Cloud) provides secret scanning, vulnerability scanning, and infrastructure-as-code scanning integrated into Azure DevOps and GitHub. Option B is wrong because Azure Policy enforces compliance but does not scan code. Option C is wrong because Microsoft Purview is for data governance. Option D is wrong because GitHub Advanced Security is for GitHub, not Azure DevOps; Defender for DevOps supports Azure DevOps.

Answer

Azure Policy

Answer

Microsoft Purview

Answer

GitHub Advanced Security

Question 4

Which TWO actions align with the Zero Trust principle of 'verify explicitly'? (Select two.)

Accepted Answer

Use conditional access policies to evaluate user and device risk before granting access. Option B is correct because conditional access policies evaluate real-time signals such as user identity, device compliance, location, and risk level before granting access to resources. This aligns with the Zero Trust principle of 'verify explicitly' by requiring continuous validation of every access request rather than trusting based on network location alone.

Answer

Deploy a VPN for remote access

Answer

Encrypt all data at rest

Answer

Implement network segmentation to limit lateral movement

Question 5

Which THREE are security best practices for Microsoft Entra ID? (Select three.)

Accepted Answer

Block legacy authentication protocols. Legacy authentication protocols (e.g., POP3, SMTP, IMAP4, and older versions of Office clients) do not support modern security controls like multifactor authentication (MFA) or conditional access. Blocking these protocols is a critical security best practice because they bypass MFA requirements, leaving accounts vulnerable to password spray and credential-stuffing attacks. Microsoft Entra ID allows administrators to block legacy authentication via Conditional Access policies or tenant-wide settings.

Answer

Disable self-service password reset for users

Answer

Synchronize all on-premises user accounts to Microsoft Entra ID

Question 6

Which TWO are recommended practices for securing Microsoft 365 workloads? (Select two.)

Accepted Answer

Enable unified audit logging in Microsoft Purview. Unified audit logging in Microsoft Purview is a recommended practice because it provides a centralized, searchable record of user and admin activities across Microsoft 365 workloads, which is essential for security investigations, compliance, and threat detection. Enabling this logging ensures that events such as mailbox access, file downloads, and admin role changes are captured and retained, supporting incident response and forensic analysis.

Answer

Allow external sharing for all SharePoint sites

Answer

Disable multifactor authentication for users who access from trusted IPs

Answer

Allow all third-party apps to access Microsoft 365 data

Question 7

Refer to the exhibit. You are reviewing a conditional access policy. What is the effect of this policy?

Accepted Answer

Requires multifactor authentication for Global Administrators and Security Administrators. Option D is correct because the exhibit shows a conditional access policy that targets the 'Global Administrators' and 'Security Administrators' directory roles, and the policy is configured to 'Require multifactor authentication' for those roles. The policy is enabled (as indicated by the 'On' toggle), so it actively enforces MFA for members of those two admin roles, blocking access if they do not complete MFA. This aligns with the principle of securing high-privilege roles with stronger authentication.

Answer

The policy is disabled and has no effect

Answer

Blocks access for all users

Answer

Requires multifactor authentication for all users

Question 8

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

Identify the top 10 users who have been targeted by Mimikatz attacks. The KQL query uses the `summarize` operator with `count()` to aggregate Mimikatz alerts by `UserPrincipalName`, then sorts the results by count in descending order and limits the output to 10 rows. This directly identifies the top 10 users who have been targeted by Mimikatz attacks, as each alert represents a detection event associated with a specific user.

Answer

Show the severity of Mimikatz alerts for each user

Answer

List all Mimikatz alerts with detailed entity information

Answer

Count the total number of Mimikatz alerts in the last 7 days

Question 9

Refer to the exhibit. You are reviewing an ARM template snippet for an Azure Storage container. Which security best practice does this configuration enforce?

Accepted Answer

Disables anonymous public access to the container. The ARM template snippet sets the `publicAccess` property of the container to `None`. This explicitly disables anonymous public access to the container, enforcing the security best practice of preventing unauthenticated access to Azure Storage data. By default, Azure Storage containers allow anonymous read access if enabled at the account level, but this configuration overrides that to block any public requests.

Answer

Allows public access from the internet

Answer

Configures a firewall rule to restrict access to specific IPs

Answer

Enables encryption at rest for the container

Question 10

Your organization is adopting a Zero Trust security model. You need to design a solution that ensures continuous verification of user identity and device health before granting access to resources. Which Microsoft Entra ID feature should you prioritize?

Accepted Answer

Microsoft Entra ID Conditional Access. Option C is correct because Conditional Access is the primary Microsoft Entra ID feature that enforces continuous verification by evaluating user identity, device health (via compliance policies or Microsoft Defender for Endpoint signals), location, and risk in real-time before granting access. It directly supports the Zero Trust principle of 'never trust, always verify' by requiring authentication and authorization at every access attempt, not just at the perimeter.

Answer

Microsoft Entra ID Domain Services

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Question 11

Your organization wants to implement a security baseline for Azure resources using built-in policies. Which Azure service should you use to assign policies that enforce compliance with security best practices?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules and effects on your Azure resources. These policies can be used to implement a security baseline by ensuring resources comply with built-in security best practices, such as requiring encryption or restricting resource types. Azure Policy evaluates resources against assigned policies and can automatically remediate non-compliant resources.

Answer

Azure Blueprints

Answer

Microsoft Defender for Cloud

Answer

Azure Role-Based Access Control (RBAC)

Question 12

Your organization uses Microsoft Defender XDR for incident response. You need to design a process to automatically isolate a compromised device when a high-severity incident is triggered. Which automation approach should you use?

Accepted Answer

Use automation rules in Microsoft Sentinel with a playbook that runs a Defender for Endpoint isolation action. Option D is correct because Microsoft Sentinel's automation rules can directly trigger a playbook (Azure Logic App) that executes the Microsoft Defender for Endpoint 'Isolate device' action. This provides near-real-time, event-driven isolation without polling, aligning with the requirement to automatically isolate a compromised device when a high-severity incident is triggered in Defender XDR.

Answer

Create a compliance policy in Microsoft Intune that marks the device as noncompliant

Answer

Configure an Azure Automation runbook to poll Defender alerts and isolate devices

Answer

Set up a Power Automate flow triggered by email notifications from Defender

Question 13

Your organization is planning to deploy Microsoft Purview Information Protection to classify and protect sensitive data. You need to design a solution that automatically applies sensitivity labels to documents containing personally identifiable information (PII) when they are uploaded to SharePoint Online. Which configuration should you use?

Accepted Answer

Create an auto-labeling policy that uses a sensitive info type for PII. Option C is correct because Microsoft Purview auto-labeling policies can automatically apply sensitivity labels to documents containing PII when they are uploaded to SharePoint Online. By configuring a policy with a sensitive info type (e.g., U.S. Social Security Number) as the condition, the service scans content at rest and applies the label without user intervention, meeting the requirement for automatic classification.

Answer

Set a default sensitivity label for the SharePoint site

Answer

Use trainable classifiers to identify PII and apply labels

Answer

Configure a manual labeling policy that prompts users to classify documents

Question 14

Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to design a solution that ensures all user authentication requests are evaluated by Conditional Access policies before granting access to cloud apps. However, some legacy apps still require basic authentication. What should you recommend?

Accepted Answer

Enable authentication policies in Microsoft Entra ID to block legacy authentication. Option A is correct because enabling authentication policies in Microsoft Entra ID to block legacy authentication ensures that all user authentication requests are evaluated by Conditional Access policies before granting access to cloud apps. Legacy authentication protocols (e.g., POP3, IMAP, SMTP, basic auth) bypass modern authentication and Conditional Access, so blocking them forces clients to use modern protocols (OAuth 2.0, OpenID Connect) that are subject to Conditional Access evaluation. This directly addresses the requirement while allowing legacy apps to be updated or replaced over time.

Answer

Configure Active Directory Federation Services (AD FS) as the identity provider

Answer

Deploy Microsoft Entra Application Proxy for all legacy apps

Answer

Enable pass-through authentication (PTA) to forward authentication requests

Question 15

Your organization uses Microsoft Sentinel for security operations. You need to design a solution to automatically respond to a DDoS attack detected by Azure DDoS Protection. The response should include blocking the attacker's IP address in Azure Firewall and sending an alert to the security team. Which approach should you use?

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers a playbook to block the IP in Azure Firewall. Option D is correct because Microsoft Sentinel automation rules can trigger a playbook (an Azure Logic App) when a DDoS attack detection alert fires. The playbook can execute an action to block the attacker's IP address in Azure Firewall via its REST API or PowerShell cmdlets, and simultaneously send an alert to the security team (e.g., via email or Teams). This provides an automated, orchestrated response directly from the SIEM, aligning with security operations best practices.

Answer

Configure an alert rule in Azure Monitor to send an email to the security team

Answer

Use Azure Policy to deny network traffic from the attacker's IP range

Answer

Configure a resource lock on the Azure Firewall to prevent changes