SC-100 Design solutions that align with security best practices and priorities Practice Test 8 — 15 Questions

Question 1

Your organization is implementing a secure DevOps pipeline for a critical application. You need to design a solution that scans container images for vulnerabilities before they are deployed to production. Which Azure service should you integrate into the pipeline?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (formerly Azure Security Center) provides integrated vulnerability assessment for container images stored in Azure Container Registry (ACR). When integrated into a DevOps pipeline, Defender for Cloud can scan images on push or on demand, using the Qualys scanner to detect CVEs and generate detailed security reports. This allows the pipeline to block or flag vulnerable images before they reach production, directly addressing the requirement for pre-deployment vulnerability scanning.

Answer

Azure Key Vault

Answer

Azure Policy

Answer

Azure Security Center

Question 2

Your organization is deploying Microsoft Copilot for Security (Microsoft 365 Copilot). You need to design a solution that ensures Copilot queries are audited and that access to Copilot is restricted to authorized users based on their role. Which Microsoft Purview capabilities should you use together?

Accepted Answer

Audit (Standard) and Communication Compliance. Audit (Standard) captures and logs all Copilot for Security queries, providing a record of who asked what and when. Communication Compliance then allows you to define policies to review those queries for policy violations, such as unauthorized data sharing or inappropriate content, and restrict access based on user roles. Together, they fulfill both the auditing and role-based access control requirements.

Answer

Data Lifecycle Management and Records Management

Answer

Data Loss Prevention (DLP) and Insider Risk Management

Answer

eDiscovery and Compliance Manager

Question 3

Your organization wants to implement a security information and event management (SIEM) solution that can ingest logs from multiple sources, including on-premises servers, Azure resources, and third-party SaaS applications. Which Microsoft service should you choose?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct choice because it is a cloud-native SIEM solution specifically designed to ingest logs from diverse sources, including on-premises servers, Azure resources, and third-party SaaS applications, using built-in connectors for over 100 data sources. It provides centralized security analytics, threat detection, and incident response, making it the appropriate service for this multi-source log ingestion requirement.

Answer

Microsoft Purview

Answer

Microsoft Defender for Cloud

Answer

Azure Monitor

Question 4

Your organization is implementing Microsoft Intune for mobile device management. You need to design a solution that ensures corporate data on mobile devices is protected if the device is lost or stolen. Which TWO actions should you configure?

Accepted Answer

Configure a compliance policy that requires device encryption. Option B is correct because a compliance policy requiring device encryption ensures that if a device is lost or stolen, the data stored on it is unreadable without the decryption key. Intune compliance policies evaluate encryption status (e.g., BitLocker on Windows, FileVault on macOS, or device encryption on iOS/Android) and mark noncompliant devices for conditional access blocking, preventing unauthorized access to corporate data.

Answer

Enforce a minimum PIN length on devices

Answer

Require app protection policies (MAM) for all apps

Answer

Enable jailbreak detection in a device compliance policy

Question 5

Your organization is designing a secure access solution for a partner company that needs to access specific SharePoint Online sites. You need to implement Microsoft Entra ID B2B collaboration. Which THREE configurations are essential for a secure B2B collaboration setup?

Accepted Answer

Configure cross-tenant access settings in Microsoft Entra ID. Option A is correct because cross-tenant access settings in Microsoft Entra ID allow you to control inbound and outbound access for B2B collaboration, including trust settings for MFA and device compliance. This is essential to define which partner tenants can access your resources and under what conditions, preventing unauthorized access.

Answer

Use B2B direct connect for SharePoint site access

Answer

Allow all external domains to invite users without restrictions

Question 6

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. You need to design a policy that prevents users from sharing credit card numbers via email. Which THREE components are required to build this DLP policy?

Accepted Answer

A rule that includes a sensitive info type for credit card numbers. Option B is correct because a DLP policy must include a rule that defines the sensitive data to detect. For credit card numbers, Microsoft Purview provides a built-in sensitive info type (SIT) that uses pattern matching, checksum validation, and keyword proximity to accurately identify credit card numbers. Without this rule, the policy would have no criteria to trigger actions.

Answer

A policy tip to warn users before sending

Answer

A trainable classifier for financial data

Question 7

You are designing a Zero Trust architecture for a company that uses Microsoft Entra ID and Microsoft Intune. The security team wants to enforce device compliance before granting access to cloud apps. Which policy should you implement?

Accepted Answer

Microsoft Entra Conditional Access policy requiring compliant device. Option C is correct because Microsoft Entra Conditional Access policies can require that devices are marked as compliant by Microsoft Intune before granting access to cloud apps. This directly enforces device compliance as a condition for access, which is a core Zero Trust principle of verifying every access request based on device health.

Answer

Microsoft Entra Identity Protection user risk policy

Answer

Microsoft Defender for Cloud Apps session policy

Answer

Azure AD Identity Protection sign-in risk policy

Question 8

Your organization is migrating on-premises workloads to Azure and wants to use Microsoft Defender for Cloud to secure the environment. The compliance team requires that all critical vulnerabilities be remediated within 30 days. What is the most efficient way to track and enforce this?

Accepted Answer

Use Microsoft Defender for Cloud regulatory compliance dashboard with a custom initiative. Option D is correct because Microsoft Defender for Cloud's regulatory compliance dashboard allows you to apply a custom initiative (e.g., based on the Microsoft Cloud Security Benchmark or a custom policy set) that maps specific security recommendations to compliance controls. By setting the initiative to enforce a 30-day remediation SLA via Azure Policy's 'deployIfNotExists' or 'modify' effects, you can automatically track compliance status and trigger remediation actions, meeting the compliance team's requirement efficiently.

Answer

Configure Azure Policy to auto-remediate all Defender for Cloud recommendations

Answer

Create a custom Azure Dashboard and manually update it weekly

Answer

Enable automatic VM patching in Azure Update Manager

Question 9

A company is adopting Microsoft Purview for data security. They need to prevent users from sharing sensitive data like credit card numbers via email. Which feature should you configure?

Accepted Answer

Data Loss Prevention (DLP) policy. Data Loss Prevention (DLP) policies in Microsoft Purview are specifically designed to detect and prevent the accidental or intentional sharing of sensitive information, such as credit card numbers, through email and other channels. By configuring a DLP policy with a rule that scans for credit card number patterns (using predefined or custom sensitive info types), the system can block, quarantine, or notify users when such data is sent via Exchange Online. This directly addresses the requirement to prevent sharing sensitive data via email.

Answer

Audit log search

Answer

Insider Risk Management policy

Answer

Sensitivity labels

Question 10

Your organization uses Microsoft Sentinel for SIEM. You need to ensure that security incidents are automatically responded to without human intervention for known false positives. What should you implement?

Accepted Answer

An automation rule with incident closure action. Option D is correct because automation rules in Microsoft Sentinel can be configured to automatically close incidents when specific conditions are met, such as when an incident is identified as a known false positive. This eliminates the need for human intervention by triggering an incident closure action based on predefined criteria, directly addressing the requirement for automated response to false positives.

Answer

An analytics rule with alert suppression

Answer

A playbook that runs on incident creation

Answer

An entity behavior analytics rule

Question 11

A company wants to use Microsoft Defender XDR to detect and respond to advanced persistent threats (APTs). They have deployed Defender for Endpoint, Defender for Office 365, and Defender for Identity. What additional step is critical to correlate signals across these products?

Accepted Answer

Enable the Microsoft Defender XDR unified experience in the portal. Enabling the Microsoft Defender XDR unified experience in the portal is critical because it aggregates and correlates signals from Defender for Endpoint, Defender for Office 365, and Defender for Identity into a single incident queue and unified alert timeline. Without this step, each product operates in isolation, preventing cross-product detection of multi-stage APT attacks that span endpoints, email, and identity. The unified experience activates the Microsoft 365 Defender portal's correlation engine, which uses machine learning to link related alerts across domains into a single incident.

Answer

Configure Microsoft Defender for Cloud servers plan

Answer

Assign Microsoft 365 E5 licenses to all users

Answer

Deploy Microsoft Defender for Office 365 Safe Links

Question 12

Your organization uses Microsoft Intune to manage devices. You need to ensure that only devices with a specific minimum OS version can access corporate resources. Which configuration should you use?

Accepted Answer

Device compliance policy with minimum OS version rule. A device compliance policy with a minimum OS version rule is the correct choice because Intune compliance policies evaluate device attributes—including OS version—against defined rules before granting access to corporate resources. When a device fails the minimum OS version check, Conditional Access blocks access until the device is updated or remediated, ensuring only compliant devices can connect.

Answer

Device configuration profile

Answer

Enrollment restrictions

Answer

App protection policy

Question 13

A company uses Microsoft Entra ID with P2 licenses. They want to implement a Zero Trust approach that requires step-up authentication for accessing high-value data in SharePoint. The solution must use risk-based policies and minimize user friction. Which combination should you recommend?

Accepted Answer

Microsoft Entra Conditional Access with sign-in risk policy and authentication context for sensitive data. Option B is correct because it combines Conditional Access with a sign-in risk policy (from Identity Protection) and an authentication context that is applied to sensitive SharePoint data. This enforces step-up authentication only when risk is detected and the user accesses high-value data, minimizing friction for low-risk sessions while meeting Zero Trust requirements.

Answer

Microsoft Entra Conditional Access with trusted locations policy

Answer

Azure AD Conditional Access with MFA for all SharePoint access

Answer

Microsoft Entra Identity Protection user risk policy with MFA

Question 14

Your organization plans to use Microsoft Defender for Cloud to secure Azure resources. The security team wants to continuously assess compliance against the CIS Azure Foundations Benchmark. What should you do?

Accepted Answer

Enable the CIS Azure Foundations Benchmark in Defender for Cloud regulatory compliance dashboard. Option C is correct because Microsoft Defender for Cloud's regulatory compliance dashboard includes built-in support for the CIS Azure Foundations Benchmark. By enabling this standard in the dashboard, Defender for Cloud continuously assesses your Azure resources against all CIS controls, providing automated compliance scores and remediation recommendations without requiring custom definitions or manual policy assignments.

Answer

Create a custom Azure Blueprint for CIS

Answer

Deploy Azure Security Center (legacy)

Answer

Assign Azure Policy for all CIS controls manually

Question 15

A company uses Microsoft Entra ID and wants to enable passwordless authentication for all users to reduce phishing risks. Users are already using Microsoft Authenticator for MFA. Which passwordless method should you prioritize?

Accepted Answer

Microsoft Authenticator passwordless sign-in. Option D is correct because the organization already uses Microsoft Authenticator for MFA, making the transition to passwordless sign-in via Authenticator the most seamless and cost-effective path. This method leverages the existing app registration and push notification infrastructure, allowing users to authenticate with a biometric or PIN gesture without deploying additional hardware or certificates.

Answer

Windows Hello for Business

Answer

FIDO2 security keys

Answer

Certificate-based authentication