SC-100 Design solutions that align with security best practices and priorities Practice Test 7 — 15 Questions

Question 1

You are a security architect for a large enterprise that is migrating to Microsoft 365. The organization has 50,000 users across multiple regions. They have recently experienced a ransomware attack that encrypted files on SharePoint Online and OneDrive for Business. The security team wants to implement a comprehensive protection strategy. Requirements: 1. Automatically detect and block ransomware-like behavior in real-time. 2. Provide users with self-service recovery of files encrypted by ransomware. 3. Ensure that all files in SharePoint and OneDrive are scanned for malware upon upload. 4. Minimize administrative overhead. Which combination of Microsoft 365 security features should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Microsoft Defender for Office 365 to scan files on upload and use version history and recycle bin for recovery.. Microsoft Defender for Office 365 provides real-time scanning of files uploaded to SharePoint and OneDrive, detecting and blocking known malware. Combined with version history and the recycle bin, users can self-recover files encrypted by ransomware without administrative intervention, satisfying all requirements with minimal overhead.

Answer

Use Microsoft Entra ID Protection to detect compromised accounts and automatically block access.

Answer

Enable Microsoft Endpoint DLP and configure file policies to block encrypted files.

Answer

Configure Microsoft Purview auto-labeling to apply a 'Ransomware' label and then block all labeled files.

Question 2

Your organization is migrating on-premises Active Directory to Microsoft Entra ID. You need to design a solution that aligns with the Zero Trust principle of 'verify explicitly'. Which approach should you recommend for user authentication?

Accepted Answer

Deploy passwordless authentication using FIDO2 security keys for all users. D is correct because FIDO2 security keys provide phishing-resistant, passwordless authentication using hardware-bound cryptographic keys. This aligns with Zero Trust 'verify explicitly' by ensuring each sign-in uses strong, multi-factor verification without shared secrets. While Windows Hello for Business also offers similar phishing-resistant properties, it is often paired with password recovery (as in option B), which undermines a strict passwordless strategy. FIDO2 keys, when deployed for all users, provide the most consistent and explicit method of verifying identity.

Answer

Deploy passwordless authentication using Microsoft Authenticator with phone sign-in for all users

Answer

Enable users to sign in with Windows Hello for Business and allow password recovery via self-service

Answer

Implement password hash synchronization and enforce MFA only for privileged users

Question 3

You are designing a security baseline for Azure resources that host a critical application. The application uses Azure SQL Database, Azure Storage, and Azure Key Vault. You need to ensure that all resources use managed identities for authentication and that no secrets are stored in code or configuration files. Which combination of controls should you include in the baseline?

Accepted Answer

Use system-assigned managed identities for all resources. Configure each resource to use the managed identity. Disable local authentication on Key Vault and Storage. Enable Azure AD-only authentication on SQL Database.. The correct answer is C because it fully uses system-assigned managed identities for authentication to SQL, Storage, and Key Vault, and disables alternative authentication methods (shared keys for Storage, local auth for Key Vault, SQL authentication for SQL Database). This ensures no secrets are stored in code or configuration files, as the application uses managed identity to obtain Azure AD tokens.

Answer

Use user-assigned managed identities for all resources. Configure Key Vault access policies to allow the managed identity. Disable anonymous access to Storage.

Answer

Use system-assigned managed identities for all resources. Store connection strings in Key Vault secrets and configure SQL Database to use Azure AD authentication.

Answer

Use user-assigned managed identities for all resources. Create a service principal with a client secret for Key Vault access.

Question 4

Your company is implementing Microsoft Purview Information Protection to protect sensitive data. The compliance team requires that when a user applies a 'Highly Confidential' sensitivity label to a document, the document is automatically encrypted and watermarked. Which configuration should you use?

Accepted Answer

Configure the sensitivity label to apply encryption and dynamic watermarking. Publish the label to users.. Microsoft Purview sensitivity labels can be configured to automatically apply encryption and dynamic watermarking when a user manually applies the label. This meets the requirement that the user applies the label and the document gets encrypted and watermarked. Option A is incorrect because DLP policies can apply actions like blocking or alerting, but they do not apply encryption or watermarking directly. Option B is incorrect because auto-labeling policies apply labels automatically based on conditions, not based on user action. Option C is incorrect because Conditional Access policies control access based on conditions, they do not apply labels or watermarks to documents.

Answer

Create a DLP policy that encrypts and watermarks the document when it is shared externally

Answer

Create an auto-labeling policy that detects sensitive content and applies the label automatically

Answer

Create a Conditional Access policy that requires the label to be applied to all documents

Question 5

Your organization uses Microsoft Sentinel as its SIEM. You need to design a solution to automatically respond to detected threats in Azure resources. The response must include isolating the affected virtual machine and creating a support ticket. Which approach should you use?

Accepted Answer

Create a Microsoft Sentinel automation rule that triggers a playbook when an incident is generated. The playbook uses Azure Logic Apps to isolate the VM and create a ticket in your IT service management tool.. Microsoft Sentinel automation rules can trigger playbooks (Azure Logic Apps) when incidents are generated. Logic Apps provide native connectors to isolate Azure VMs (via the Azure Resource Manager connector) and create tickets in IT service management tools (e.g., ServiceNow, Jira), meeting both requirements in a single automated workflow.

Answer

Create an Azure Policy initiative that automatically remediates non-compliant resources

Answer

Create a Microsoft Sentinel analytics rule that runs a KQL query and automatically sends an email to the security team

Answer

Create an Azure Automation runbook that runs on a schedule to check for threats and isolate VMs

Question 6

Your organization is implementing a Zero Trust architecture for access to cloud applications. Which TWO of the following are core components of the Microsoft Zero Trust model?

Accepted Answer

Conditional Access policies that enforce access decisions based on user, device, location, and risk. Conditional Access policies are the core policy engine in Microsoft's Zero Trust model, enforcing access decisions dynamically based on signals such as user identity, device health, location, and real-time risk. This aligns with the Zero Trust principle of 'never trust, always verify' by continuously evaluating each access request.

Answer

Microsoft Purview Data Loss Prevention policies to protect sensitive data

Answer

Microsoft Intune for mobile device management and application management

Answer

Microsoft Defender for Cloud to assess the security posture of cloud workloads

Question 7

Your company is designing a secure access strategy for a SaaS application that supports SAML 2.0. You need to enforce phishing-resistant authentication. Which THREE of the following methods meet the requirement?

Accepted Answer

FIDO2 security keys. FIDO2 security keys (Option B) are phishing-resistant because they use public-key cryptography and are bound to a specific web origin, preventing credential reuse on fake sites. The WebAuthn protocol ensures the private key never leaves the device, and the hardware key provides strong multi-factor authentication that cannot be intercepted or relayed.

Answer

Microsoft Authenticator push notifications

Answer

SMS one-time passcode (OTP)

Question 8

Your organization wants to implement a defense-in-depth strategy for Azure virtual machines. Which THREE of the following should you include?

Accepted Answer

Azure Disk Encryption for OS and data disks. Azure Disk Encryption (ADE) uses BitLocker for Windows and DM-Crypt for Linux to encrypt OS and data disks at rest, protecting against unauthorized access to the physical disk. This is a foundational layer of defense-in-depth, ensuring that if an attacker gains access to the disk, the data remains unreadable without the encryption keys stored in Azure Key Vault.

Answer

Azure Firewall to inspect all traffic to the VMs

Answer

Azure Bastion to provide secure RDP and SSH access

Question 9

You are designing a solution to protect Microsoft 365 data from insider threats. Which TWO Microsoft Purview features should you use?

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management is correct because it is specifically designed to detect, investigate, and act on malicious and accidental insider risks by correlating signals from Microsoft 365 and Azure services, such as unusual file downloads or data exfiltration patterns. It uses predefined risk indicators and machine learning models to identify risky user activities that could lead to data breaches, making it a primary tool for protecting data from insider threats.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Audit (Premium)

Answer

Microsoft Purview eDiscovery (Premium)

Question 10

You are a security architect for a large enterprise that is migrating to Microsoft 365. The organization has 50,000 users across multiple regions. They have recently experienced a ransomware attack that encrypted files on SharePoint Online and OneDrive for Business. The security team wants to implement a comprehensive protection strategy. Requirements: 1. Automatically detect and block ransomware-like behavior in real-time. 2. Provide users with self-service recovery of files encrypted by ransomware. 3. Ensure that all files in SharePoint and OneDrive are scanned for malware upon upload. 4. Minimize administrative overhead. Which combination of Microsoft 365 security features should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement Microsoft Defender for Office 365 to block phishing emails. Use Conditional Access policies with session risk to enforce access controls. Deploy Microsoft Purview DLP and sensitivity labels to protect data. Use Microsoft Sentinel with automation rules and playbooks to detect and respond to incidents.. It combines Microsoft Defender for Office 365 to block phishing emails, Conditional Access policies with session risk to enforce least privilege, Microsoft Purview DLP and sensitivity labels to protect data, and Microsoft Sentinel with automation rules and playbooks to detect and respond to incidents. Option A is wrong because it uses Microsoft Defender for Cloud Apps and Conditional Access with app control, but lacks phishing prevention (Defender for Office 365) and proper monitoring (Azure Sentinel instead of Microsoft Sentinel). Option B is wrong because it uses Microsoft Entra ID Protection and Conditional Access with MFA, but does not include phishing prevention (Defender for Office 365) and uses Azure Monitor instead of Microsoft Sentinel for detection and response. Option D is wrong because it uses Microsoft Defender for Identity and Azure Security Center, which are not comprehensive for cloud and email protection, and lacks Microsoft Purview DLP and sensitivity labels for data protection.

Answer

Implement Microsoft Defender for Cloud Apps to discover and control SaaS apps. Use Conditional Access with app control. Deploy Microsoft Purview Data Lifecycle Management. Use Azure Sentinel for monitoring.

Answer

Implement Microsoft Entra ID Protection to detect and block risky sign-ins. Use Conditional Access policies to require MFA and block legacy authentication. Use Microsoft Purview sensitivity labels to classify data and Azure Monitor to collect logs.

Answer

Implement Microsoft Defender for Identity to detect on-premises threats. Use Conditional Access with device compliance policies. Deploy Microsoft Purview Information Protection. Use Azure Security Center for monitoring.

Question 11

Your organization is deploying a new application on Azure that will process personal data for European Union residents. The compliance team requires that the application encrypts all data at rest and in transit, that access to the data is logged and auditable, and that the data is not stored outside the EU. You need to design a solution that meets these requirements while following security best practices. The solution must also minimize operational overhead. You have decided to use Azure SQL Database, Azure Storage, and Azure Key Vault. Which design should you recommend?

Accepted Answer

Use Azure SQL Database with Transparent Data Encryption (TDE) using service-managed keys. Enforce TLS 1.2 for connections. Use Azure Storage with encryption at rest using Microsoft-managed keys. Store keys in Azure Key Vault. Configure geo-redundant storage (GRS) in an EU region. Enable diagnostic settings to send logs to a Log Analytics workspace in the EU.. A correct design to meet all requirements with minimal operational overhead would use TDE with service-managed keys (no Key Vault needed), enforce TLS 1.2, use Azure Storage encryption with Microsoft-managed keys, configure geo-redundant storage within the EU, enable SQL Auditing, and stream audit logs via diagnostic settings to a Log Analytics workspace in the EU. Since the provided option D includes the Key Vault contradiction and omits explicit SQL Auditing, it is not fully correct.

Answer

Use Azure SQL Database with Always Encrypted using Azure Key Vault. Use Azure Storage with encryption at rest. Enforce TLS 1.2. Use Azure Traffic Manager to route traffic to EU regions. Enable SQL Auditing and export logs to an on-premises SIEM.

Answer

Use Azure SQL Database with Always Encrypted using client-managed keys stored in a config file. Enforce TLS 1.2. Use Azure Storage with client-side encryption. Store keys in Azure Key Vault. Configure LRS in EU. Enable SQL Auditing.

Answer

Use Azure SQL Database with SQL Server encryption (cell-level). Use Azure Storage with encryption at rest. Store keys in application code. Use Azure Backup for long-term retention. Enable auditing on SQL Database.

Question 12

Your organization is a small business with 50 employees that uses Microsoft 365 Business Premium. You need to design a security baseline that protects against common threats like phishing, ransomware, and data leakage. The solution must be easy to manage and require minimal ongoing effort. You have the following requirements: 1. Block malicious emails and links. 2. Protect sensitive data from being shared externally. 3. Require multi-factor authentication for all users. 4. Keep devices healthy. Which combination of policies should you implement?

Accepted Answer

Enable Microsoft Defender for Office 365 Safe Links and Safe Attachments. Create a Microsoft Purview DLP policy to prevent external sharing of sensitive data. Create a Conditional Access policy to require MFA and device compliance.. It directly addresses all four requirements: Microsoft Defender for Office 365 Safe Links and Safe Attachments blocks malicious emails and links; a Microsoft Purview DLP policy prevents external sharing of sensitive data, protecting against data leakage; a Conditional Access policy requiring MFA and device compliance enforces multi-factor authentication for all users and ensures devices are healthy. This combination is easy to manage with minimal ongoing effort, as it leverages built-in Microsoft 365 Business Premium capabilities without complex custom configurations.

Answer

Enable Microsoft Defender for Office 365 for phishing protection. Use Microsoft Purview Information Protection to automatically label sensitive emails. Create a Conditional Access policy to require MFA for admins only. Use Azure Information Protection scanner.

Answer

Enable Exchange Online Protection (EOP) for spam and malware filtering. Create a Conditional Access policy to require MFA for all users. Enable device compliance policies in Microsoft Intune.

Answer

Enable Microsoft Defender for Office 365 Safe Links and Safe Attachments. Create a Microsoft Purview DLP policy to block sharing of credit card numbers. Enable security defaults in Microsoft Entra ID to enforce MFA.

Question 13

Your organization is designing a security strategy for Microsoft 365. You need to align with Microsoft's Zero Trust best practices. Which TWO principles should be included?

Accepted Answer

Verify explicitly. Microsoft's Zero Trust model is officially defined by three core principles: verify explicitly, use least privilege, and assume breach. All three are equally fundamental to the model. The question asks for 'TWO principles' but provides no criterion to prefer one over another; therefore, any pair from A, D, and E is technically valid. However, marking D as incorrect is factually wrong. The explanation attempts to justify excluding 'Assume breach' by claiming it is 'more about designing for resilience' and less actionable, but this is an artificial distinction not present in the stem or in Microsoft documentation. The correct answer should include 'Assume breach'.

Answer

Trust but verify

Answer

Verify implicitly

Question 14

You are planning a security baseline for Azure resources using Microsoft Defender for Cloud. Which THREE recommendations are part of the Azure Security Benchmark?

Accepted Answer

Implement role-based access control (RBAC) for resource management. Options A, B, and C are all core recommendations of the Azure Security Benchmark. Option A (RBAC) falls under Identity Management (IM), Option B (MFA) also under IM, and Option C (disable TLS 1.0/enable TLS 1.2) falls under Network Security (NS). These are explicitly listed in the benchmark. Option D (Point-to-Site VPN) is not a benchmark recommendation. Option E (NSGs on subnets) is a valid security practice but is not one of the three specific recommendations asked for; the benchmark includes broader network security controls.

Answer

Use Point-to-Site VPN for remote access

Answer

Enable network security groups on subnets to restrict traffic

Question 15

Contoso is a financial services company migrating critical workloads to Azure. They must comply with PCI DSS and have a Security Operations Center (SOC) team that uses Microsoft Sentinel. The CISO wants to ensure that the security posture aligns with Microsoft's cybersecurity reference architecture (MCRA). You need to design a solution that includes the following requirements: 1) All Azure subscriptions must be managed under a single management group hierarchy with consistent policies. 2) The SOC must have a centralized view of security alerts across all resources, including on-premises servers and multi-cloud environments. 3) Privileged access to Azure resources must be protected using just-in-time (JIT) access and Privileged Identity Management (PIM). 4) Compliance with PCI DSS must be continuously monitored and reported. 5) The solution must minimize operational overhead. What should you include in the design?

Accepted Answer

Deploy a single management group containing all subscriptions. Enable Microsoft Defender for Cloud with the 'PCI DSS v3.2.1' regulatory compliance dashboard on the management group. Configure Azure Policy to enforce security standards. Enable PIM and configure JIT VM access. Use Microsoft Sentinel as the SIEM, connecting it to Defender for Cloud and on-premises security sources.. It provides a centralized management group structure for consistent policy enforcement across all subscriptions, uses Microsoft Defender for Cloud with the PCI DSS regulatory compliance dashboard for continuous monitoring and reporting, integrates PIM and JIT for privileged access protection, and uses Microsoft Sentinel as the SIEM to aggregate alerts from Defender for Cloud and on-premises/multi-cloud sources, meeting all requirements with minimal overhead. Option A is incorrect because it creates separate management groups per business unit, which lacks centralized policy enforcement, and uses a third-party SIEM instead of Sentinel, increasing cost and complexity. Option C is incorrect because it relies on manual monitoring via secure score and omits JIT, failing to meet compliance and privileged access requirements. Option D is incorrect because it bypasses Defender for Cloud's compliance and threat detection capabilities, relying solely on Azure Monitor, which is insufficient for PCI DSS monitoring and SOC needs.

Answer

Create separate management groups per business unit. Enable Microsoft Defender for Cloud on each subscription individually. Use Azure Policy to assign PCI DSS policies per subscription. Configure PIM at the tenant root management group. Use a third-party SIEM to aggregate alerts.

Answer

Deploy a management group hierarchy with policies inherited. Use Microsoft Defender for Cloud's secure score to monitor compliance manually. Implement PIM without JIT. Use Microsoft Sentinel but only for cloud workloads.

Answer

Use a single management group with Azure Policy to enforce PCI DSS controls. Rely on Azure Monitor for security alerts. Do not enable Defender for Cloud to reduce costs. Use PIM for privileged roles. Connect on-premises logs to a Log Analytics workspace for the SOC.