SC-100 Design solutions that align with security best practices and priorities Practice Test 9 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing an ARM template snippet for an Azure Storage container. Which security best practice does this configuration enforce?

Accepted Answer

Disables anonymous public access to the container. The ARM template snippet sets the `publicAccess` property of the container to `None`. This explicitly disables anonymous public access to the container, enforcing the security best practice of preventing unauthenticated access to Azure Storage data. By default, Azure Storage containers allow anonymous read access if enabled at the account level, but this configuration overrides that to block any public requests.

Answer

Allows public access from the internet

Answer

Configures a firewall rule to restrict access to specific IPs

Answer

Enables encryption at rest for the container

Question 2

Your organization is adopting a Zero Trust security model. You need to design a solution that ensures continuous verification of user identity and device health before granting access to resources. Which Microsoft Entra ID feature should you prioritize?

Accepted Answer

Microsoft Entra ID Conditional Access. Conditional Access is the primary Microsoft Entra ID feature that enforces continuous verification by evaluating user identity, device health (via compliance policies or Microsoft Defender for Endpoint signals), location, and risk in real-time before granting access. It directly supports the Zero Trust principle of 'never trust, always verify' by requiring authentication and authorization at every access attempt, not just at the perimeter.

Answer

Microsoft Entra ID Domain Services

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Question 3

Your organization wants to implement a security baseline for Azure resources using built-in policies. Which Azure service should you use to assign policies that enforce compliance with security best practices?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules and effects on your Azure resources. These policies can be used to implement a security baseline by ensuring resources comply with built-in security best practices, such as requiring encryption or restricting resource types. Azure Policy evaluates resources against assigned policies and can automatically remediate non-compliant resources.

Answer

Azure Blueprints

Answer

Microsoft Defender for Cloud

Answer

Azure Role-Based Access Control (RBAC)

Question 4

Your organization uses Microsoft Defender XDR for incident response. You need to design a process to automatically isolate a compromised device when a high-severity incident is triggered. Which automation approach should you use?

Accepted Answer

Use automation rules in Microsoft Sentinel with a playbook that runs a Defender for Endpoint isolation action. Microsoft Sentinel's automation rules can directly trigger a playbook (Azure Logic App) that executes the Microsoft Defender for Endpoint 'Isolate device' action. This provides near-real-time, event-driven isolation without polling, aligning with the requirement to automatically isolate a compromised device when a high-severity incident is triggered in Defender XDR.

Answer

Create a compliance policy in Microsoft Intune that marks the device as noncompliant

Answer

Configure an Azure Automation runbook to poll Defender alerts and isolate devices

Answer

Set up a Power Automate flow triggered by email notifications from Defender

Question 5

Your organization is planning to deploy Microsoft Purview Information Protection to classify and protect sensitive data. You need to design a solution that automatically applies sensitivity labels to documents containing personally identifiable information (PII) when they are uploaded to SharePoint Online. Which configuration should you use?

Accepted Answer

Create an auto-labeling policy that uses a sensitive info type for PII. Microsoft Purview auto-labeling policies can automatically apply sensitivity labels to documents containing PII when they are uploaded to SharePoint Online. By configuring a policy with a sensitive info type (e.g., U.S. Social Security Number) as the condition, the service scans content at rest and applies the label without user intervention, meeting the requirement for automatic classification.

Answer

Set a default sensitivity label for the SharePoint site

Answer

Use trainable classifiers to identify PII and apply labels

Answer

Configure a manual labeling policy that prompts users to classify documents

Question 6

Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to design a solution that ensures all user authentication requests are evaluated by Conditional Access policies before granting access to cloud apps. However, some legacy apps still require basic authentication. What should you recommend?

Accepted Answer

Enable authentication policies in Microsoft Entra ID to block legacy authentication. Enabling authentication policies in Microsoft Entra ID to block legacy authentication ensures that all user authentication requests are evaluated by Conditional Access policies before granting access to cloud apps. Legacy authentication protocols (e.g., POP3, IMAP, SMTP, basic auth) bypass modern authentication and Conditional Access, so blocking them forces clients to use modern protocols (OAuth 2.0, OpenID Connect) that are subject to Conditional Access evaluation. This directly addresses the requirement while allowing legacy apps to be updated or replaced over time.

Answer

Configure Active Directory Federation Services (AD FS) as the identity provider

Answer

Deploy Microsoft Entra Application Proxy for all legacy apps

Answer

Enable pass-through authentication (PTA) to forward authentication requests

Question 7

Your organization uses Microsoft Sentinel for security operations. You need to design a solution to automatically respond to a DDoS attack detected by Azure DDoS Protection. The response should include blocking the attacker's IP address in Azure Firewall and sending an alert to the security team. Which approach should you use?

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers a playbook to block the IP in Azure Firewall. Microsoft Sentinel automation rules can trigger a playbook (an Azure Logic App) when a DDoS attack detection alert fires. The playbook can execute an action to block the attacker's IP address in Azure Firewall via its REST API or PowerShell cmdlets, and simultaneously send an alert to the security team (e.g., via email or Teams). This provides an automated, orchestrated response directly from the SIEM, aligning with security operations best practices.

Answer

Configure an alert rule in Azure Monitor to send an email to the security team

Answer

Use Azure Policy to deny network traffic from the attacker's IP range

Answer

Configure a resource lock on the Azure Firewall to prevent changes

Question 8

Your organization is implementing a secure DevOps pipeline for a critical application. You need to design a solution that scans container images for vulnerabilities before they are deployed to production. Which Azure service should you integrate into the pipeline?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (formerly Azure Security Center) provides integrated vulnerability assessment for container images stored in Azure Container Registry (ACR). When integrated into a DevOps pipeline, Defender for Cloud can scan images on push or on demand, using the Qualys scanner to detect CVEs and generate detailed security reports. This allows the pipeline to block or flag vulnerable images before they reach production, directly addressing the requirement for pre-deployment vulnerability scanning.

Answer

Azure Key Vault

Answer

Azure Policy

Answer

Azure Security Center

Question 9

Your organization wants to implement a security information and event management (SIEM) solution that can ingest logs from multiple sources, including on-premises servers, Azure resources, and third-party SaaS applications. Which Microsoft service should you choose?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct choice because it is a cloud-native SIEM solution specifically designed to ingest logs from diverse sources, including on-premises servers, Azure resources, and third-party SaaS applications, using built-in connectors for over 100 data sources. It provides centralized security analytics, threat detection, and incident response, making it the appropriate service for this multi-source log ingestion requirement.

Answer

Microsoft Purview

Answer

Microsoft Defender for Cloud

Answer

Azure Monitor

Question 10

Your organization is implementing Microsoft Intune for mobile device management. You need to design a solution that ensures corporate data on mobile devices is protected if the device is lost or stolen. Which TWO actions should you configure?

Accepted Answer

Configure a compliance policy that requires device encryption. A compliance policy requiring device encryption ensures that if a device is lost or stolen, the data stored on it is unreadable without the decryption key. Intune compliance policies evaluate encryption status (e.g., BitLocker on Windows, FileVault on macOS, or device encryption on iOS/Android) and mark noncompliant devices for conditional access blocking, preventing unauthorized access to corporate data.

Answer

Enforce a minimum PIN length on devices

Answer

Require app protection policies (MAM) for all apps

Answer

Enable jailbreak detection in a device compliance policy

Question 11

Your organization is designing a secure access solution for a partner company that needs to access specific SharePoint Online sites. You need to implement Microsoft Entra ID B2B collaboration. Which THREE configurations are essential for a secure B2B collaboration setup?

Accepted Answer

Configure cross-tenant access settings in Microsoft Entra ID. Option A is correct because cross-tenant access settings in Microsoft Entra ID let you control inbound and outbound B2B collaboration with the partner tenant, including trust settings for MFA and device claims, which is essential for governing partner access to specific SharePoint Online sites. Option B is correct because enabling MFA for guest users strengthens authentication and reduces the risk of compromised credentials being used to access shared SharePoint resources. Option E is correct because Conditional Access policies scoped to guest users enforce sign-in controls such as MFA, compliant devices, and location restrictions, which are critical for securing B2B access. Option C is not essential here because B2B direct connect is designed for Teams shared channels and does not apply to SharePoint site access in this scenario. Option D is incorrect because allowing all external domains without restrictions removes governance and exposes the tenant to unauthorized invitations and access.

Answer

Use B2B direct connect for SharePoint site access

Answer

Allow all external domains to invite users without restrictions

Question 12

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. You need to design a policy that prevents users from sharing credit card numbers via email. Which THREE components are required to build this DLP policy?

Accepted Answer

A rule that includes a sensitive info type for credit card numbers. Option B is correct because a DLP rule must reference a sensitive information type (SIT), such as the built-in Credit Card Number SIT, to detect the credit card data the policy is meant to protect. Option D is correct because the policy must be scoped to the Exchange Online workload so that email traffic is actually evaluated by the DLP engine. Option E is correct because a rule needs an action, such as blocking the email and notifying the sender or admin, to enforce protection once credit card numbers are detected. Option A is not required because a policy tip is an optional user-notification enhancement, not a mandatory component for the policy to function. Option C is not required because trainable classifiers are used for content that is hard to identify with patterns, whereas credit card numbers are detected by a built-in sensitive information type.

Answer

A policy tip to warn users before sending

Answer

A trainable classifier for financial data

Question 13

You are designing a Zero Trust architecture for a company that uses Microsoft Entra ID and Microsoft Intune. The security team wants to enforce device compliance before granting access to cloud apps. Which policy should you implement?

Accepted Answer

Microsoft Entra Conditional Access policy requiring compliant device. Microsoft Entra Conditional Access policies can require that devices are marked as compliant by Microsoft Intune before granting access to cloud apps. This directly enforces device compliance as a condition for access, which is a core Zero Trust principle of verifying every access request based on device health.

Answer

Microsoft Entra Identity Protection user risk policy

Answer

Microsoft Defender for Cloud Apps session policy

Answer

Azure AD Identity Protection sign-in risk policy

Question 14

A company is adopting Microsoft Purview for data security. They need to prevent users from sharing sensitive data like credit card numbers via email. Which feature should you configure?

Accepted Answer

Data Loss Prevention (DLP) policy. Data Loss Prevention (DLP) policies in Microsoft Purview are specifically designed to detect and prevent the accidental or intentional sharing of sensitive information, such as credit card numbers, through email and other channels. By configuring a DLP policy with a rule that scans for credit card number patterns (using predefined or custom sensitive info types), the system can block, quarantine, or notify users when such data is sent via Exchange Online. This directly addresses the requirement to prevent sharing sensitive data via email.

Answer

Audit log search

Answer

Insider Risk Management policy

Answer

Sensitivity labels

Question 15

Your organization uses Microsoft Sentinel for SIEM. You need to ensure that security incidents are automatically responded to without human intervention for known false positives. What should you implement?

Accepted Answer

An automation rule with incident closure action. Automation rules in Microsoft Sentinel can be configured to automatically close incidents when specific conditions are met, such as when an incident is identified as a known false positive. This eliminates the need for human intervention by triggering an incident closure action based on predefined criteria, directly addressing the requirement for automated response to false positives.

Answer

An analytics rule with alert suppression

Answer

A playbook that runs on incident creation

Answer

An entity behavior analytics rule