Courseiva

Microsoft Cybersecurity Architect (SC-100) — Questions 1–75

208 questions total · 3pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 3

Page 2
1
Multi-Selecthard

Which THREE components are required to implement a secure hybrid network with Azure using a site-to-site VPN?

Select 3 answers
A.Public IP address for the VPN device
B.ExpressRoute circuit
C.VPN gateway (route-based)
D.Virtual network gateway
E.Local network gateway
AnswersA, D, E

A public IP address is required for the Azure VPN gateway to be reachable from the on-premises VPN device. This IP is assigned to the gateway's IPsec tunnel endpoint and must be a standard SKU public IP, which can be dynamic or static. Without this publicly routable address, the on-premises device cannot initiate or complete the IPsec connection, making it a mandatory component for a site-to-site VPN.

Why this answer

To implement a secure hybrid network with Azure using a site-to-site VPN, three components are required: a virtual network gateway (which provides the VPN termination), a local network gateway (which represents the on-premises network), and a public IP address (which is assigned to the virtual network gateway to enable communication over the internet). The VPN gateway (option C) is not a separate component; it is a type of virtual network gateway. An ExpressRoute circuit (option B) is for dedicated private connections, not VPN.

Exam trap

Candidates often confuse the virtual network gateway with the VPN gateway, thinking they are separate components, and may omit the public IP address. However, the virtual network gateway (option D) is the actual Azure resource, and the VPN gateway is a configuration type. Additionally, a public IP address is a required resource that must be created and assigned to the gateway.

Full explanation →
2
MCQmedium

Your company uses Microsoft Defender for Cloud Apps and wants to prevent users from uploading sensitive files to personal cloud storage apps. What should you configure?

A.Activity policy
B.App connector
C.Session policy
D.File policy
AnswerC

Session policies, part of Conditional Access App Control, route user traffic through Defender for Cloud Apps as a reverse proxy, allowing synchronous inspection of each request and response. The proxy can evaluate conditions like device compliance, user risk, or file sensitivity and then block, allow, or restrict actions — including preventing uploads to unsanctioned apps before the request is passed through. This real-time inline enforcement is exactly what the scenario requires, making session policy the correct choice.

Why this answer

Session policy in Microsoft Defender for Cloud Apps allows real-time monitoring and control of user activities based on app and content inspection. By configuring a session policy, you can block or restrict uploads of sensitive files to personal cloud storage apps like Dropbox or Google Drive during the user's session, leveraging reverse proxy capabilities to inspect and intervene in traffic.

Exam trap

The trap here is that candidates confuse 'File policy' (which governs files at rest) with 'Session policy' (which governs files in motion), leading them to select D, even though real-time upload prevention requires session-level control via reverse proxy.

How to eliminate wrong answers

Option A is wrong because Activity policies are used for auditing and generating alerts on specific activities (e.g., multiple failed logins), not for real-time blocking of file uploads. Option B is wrong because App connectors enable API-based visibility and control for connected apps (e.g., retrieving logs), but they cannot intercept and block uploads in real time during a user session. Option D is wrong because File policies are designed for scanning and governing files already stored in cloud apps (e.g., detecting DLP violations in SharePoint), not for preventing uploads at the point of action.

Full explanation →
3
MCQeasy

Your organization uses Microsoft Intune for mobile device management. You need to ensure that only devices compliant with security policies can access corporate email. What should you implement?

A.Conditional Access policy requiring compliant device
B.Microsoft Purview Data Lifecycle Management
C.Microsoft Defender for Endpoint integration
D.Microsoft Intune App Protection Policies
AnswerA

A Conditional Access policy requiring a compliant device acts as a real-time access gate at authentication, checking the device's compliance state reported by Intune against defined compliance policies. It evaluates signals such as enrollment status, device health attestation, and configured security settings, and blocks or allows access to Microsoft 365 or other cloud apps. This is the appropriate control because it enforces device-level access decisions before any session begins.

Why this answer

A is correct because a Conditional Access policy in Microsoft Entra ID can evaluate device compliance status reported by Intune before granting access to corporate email. By configuring a policy that requires a device to be marked as compliant, only devices that meet your security policies (e.g., encryption, OS version, threat level) will be allowed to authenticate and access email. This directly enforces the requirement that only compliant devices can access corporate email.

Exam trap

The trap here is that candidates often confuse Intune App Protection Policies (MAM) with device-based compliance, but MAM policies protect data at the app level and do not require the device itself to be compliant, so they do not meet the requirement of 'only compliant devices'.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview Data Lifecycle Management governs data retention and deletion policies, not real-time access control based on device compliance. Option C is wrong because Microsoft Defender for Endpoint integration provides threat detection and response on endpoints, but does not itself block access to email based on compliance status; it can feed signals into Conditional Access but is not the primary control. Option D is wrong because Intune App Protection Policies (MAM) protect data within apps without requiring device enrollment or compliance, so they do not ensure that only compliant devices can access email—they apply to apps on any device, including non-compliant ones.

Full explanation →
4
Multi-Selectmedium

A company is designing a data security strategy using Microsoft Purview. They need to identify sensitive data across their data estate, including on-premises SQL Server, Azure SQL Database, and Amazon S3. Which THREE components should they use? (Choose three.)

Select 3 answers
A.Microsoft Purview Data Estate Insights
B.Microsoft Purview External Identities
C.Microsoft Purview Data Catalog
D.Microsoft Purview Compliance Manager
E.Microsoft Purview Data Map
AnswersA, C, E

Data Estate Insights provides monitoring and reporting.

Why this answer

Microsoft Purview Data Estate Insights provides visibility into data estate health and security posture, including sensitive data discovery across on-premises SQL Server, Azure SQL Database, and Amazon S3. It aggregates scan results and offers dashboards to identify where sensitive data resides, enabling targeted classification and protection actions.

Exam trap

The trap here is that candidates confuse Compliance Manager (a compliance posture tool) with data discovery capabilities, or think External Identities (an identity feature) is relevant to scanning data sources, when in fact only Data Map, Data Catalog, and Data Estate Insights form the core trio for sensitive data identification across hybrid estates.

Full explanation →
5
MCQhard

A security team is designing a Microsoft Sentinel deployment. They need to minimize costs while ensuring critical alerts are always processed. Which data retention and ingestion strategy should they use?

A.Use Basic Logs for all data and retain for 90 days
B.Use Analytics Logs for all data and retain for 30 days
C.Use Basic Logs for critical alerts and retain for 30 days
D.Use Basic Logs for high-volume low-value data and Analytics Logs for critical alerts
AnswerD

This is the correct cost-performance trade-off: route high-volume, low-value data such as verbose firewall logs, debug traces, and raw DNS events to Basic Logs to slash ingestion costs, while steering critical security alerts and curated detection data into Analytics Logs for full KQL querying, alerting, and hunting workflows. Basic Logs' lower cost and acceptable simple-search capability align perfectly with data that is retained mainly for compliance or ad-hoc troubleshooting, while Analytics Logs' rich analytical features and long retention match the needs of high-priority security detections. Microsoft Sentinel supports this pattern natively by configuring table-level plans, enabling a single workspace to hold both tiers and ensuring that analysts can query the data that matters most with low latency. This balanced design meets both cost optimization and security operational requirements, making it the only viable answer.

Why this answer

It aligns with cost optimization and reliability requirements by using Basic Logs for high-volume, low-value data (e.g., firewall logs) and reserving Analytics Logs for critical alerts that require full query capabilities and interactive retention. This tiered approach ensures critical alerts are always processed with full fidelity while reducing storage costs for less important data.

Exam trap

The trap here is that candidates assume all data must be in Analytics Logs for security monitoring, overlooking the cost-saving strategy of tiered ingestion where Basic Logs handle high-volume, low-value data without sacrificing critical alert processing.

How to eliminate wrong answers

Option A is wrong because using Basic Logs for all data prevents critical alerts from being processed with full Analytics Logs features (e.g., advanced KQL queries, scheduled analytics rules), and 90-day retention on Basic Logs incurs unnecessary cost for low-value data. Option B is wrong because using Analytics Logs for all data maximizes cost (Analytics Logs are more expensive per GB) and 30-day retention may not meet compliance or investigation needs for critical alerts. Option C is wrong because using Basic Logs for critical alerts means they lose access to Analytics Logs capabilities (e.g., near-real-time detection, custom detections), and 30-day retention is insufficient for forensic analysis of critical incidents.

Full explanation →
6
MCQhard

Your organization uses Microsoft Sentinel and has deployed the Analytics rule 'TI map IP entity to AzureActivity' to detect suspicious activities based on threat intelligence. The SOC team reports that the rule has a high false positive rate because it matches benign IP addresses used by legitimate services. What design change should you recommend to reduce false positives while maintaining detection coverage?

A.Increase the alert threshold to require multiple occurrences within a time window.
B.Disable the rule and rely on manual hunting queries.
C.Create a watchlist of trusted IP addresses and modify the rule to exclude those IPs.
D.Create a separate analytics rule that suppresses alerts when the source IP is in a trusted list.
AnswerC

Creating a watchlist of trusted IP addresses and modifying the rule to exclude those IPs directly addresses the source of the false positives without disabling detection. In Sentinel, you can build a watchlist (e.g., via CSV or PowerShell) and then reference it in the analytics rule's KQL query using the `_GetWatchlist` function—for instance, adding a `where IPAddress !in (_GetWatchlist('TrustedIPs'))` clause. This keeps the rule active for all other IPs, ensuring genuine threat-intelligence matches still generate alerts while known benign entities are filtered out, and it allows easy updates to the trusted list without re-editing the rule each time.

Why this answer

Creating a watchlist of trusted IP addresses and modifying the TI map IP entity to AzureActivity rule to exclude those IPs directly addresses the high false positive rate caused by benign IPs. This approach preserves detection coverage for all other threat intelligence matches while filtering out known legitimate services, leveraging Sentinel's watchlist feature for dynamic exclusion without disabling the rule.

Exam trap

The trap here is that candidates may choose Option D, thinking a separate suppression rule is needed, but Microsoft Sentinel's analytics rules support direct exclusion via watchlists in the query logic, making a separate rule redundant and less reliable.

How to eliminate wrong answers

Option A is wrong because increasing the alert threshold to require multiple occurrences within a time window does not address the root cause—benign IPs matching threat intelligence—and may delay detection of genuine threats or miss single-occurrence attacks. Option B is wrong because disabling the rule and relying on manual hunting queries eliminates automated detection entirely, increasing risk and workload, which contradicts the goal of maintaining detection coverage. Option D is wrong because creating a separate analytics rule that suppresses alerts when the source IP is in a trusted list introduces unnecessary complexity and potential race conditions; suppression logic should be integrated into the original rule via exclusion, not handled as a separate rule that may not suppress alerts in time or could conflict with other rules.

Full explanation →
7
MCQeasy

Your organization uses Microsoft Sentinel as its SIEM. The security team needs to detect brute-force attacks against Azure VMs by analyzing Windows Security Event logs. Which data connector should you enable?

A.Office 365 connector
B.Azure Activity log connector
C.Microsoft Defender for Cloud connector
D.Windows Security Events via AMA connector
AnswerD

The Windows Security Events via Azure Monitor Agent (AMA) connector is purpose-built to stream Windows Event logs from servers and workstations directly into Microsoft Sentinel. Using a Data Collection Rule (DCR), it can collect the Security channel and other event channels, preserving the raw event details for detections and investigations. This is the correct connector when your organization must ingest Windows security events into Sentinel.

Why this answer

The Windows Security Events via AMA connector (D) is correct because it ingests Windows Event Logs (specifically Security logs with Event ID 4625 for failed logons) from Azure VMs into Microsoft Sentinel, enabling detection of brute-force patterns. This connector uses the Azure Monitor Agent (AMA) to collect events, which is the recommended method for modern Windows event collection in Sentinel.

Exam trap

The trap here is that candidates may confuse the Azure Activity log connector (which shows administrative actions like 'Deallocate VM') with guest OS-level security events, or mistakenly think Defender for Cloud provides raw Windows event logs instead of aggregated security alerts.

How to eliminate wrong answers

Option A is wrong because the Office 365 connector ingests audit logs from Microsoft 365 services (Exchange, SharePoint, Teams), not Windows Security Event logs from Azure VMs. Option B is wrong because the Azure Activity log connector collects subscription-level control plane events (e.g., VM creation, resource changes), not guest OS-level security events like logon failures. Option C is wrong because the Microsoft Defender for Cloud connector ingests security alerts and posture data from Defender for Cloud, not raw Windows Security Event logs needed for brute-force detection.

Full explanation →
8
MCQhard

A company is designing a security operations strategy. They want to use Microsoft Sentinel to detect and respond to threats across their hybrid environment. They need to ensure that logs from all sources are collected cost-effectively and that analysts can easily query data. Which data ingestion strategy should they recommend?

A.Send all logs to the Basic logs table to reduce costs.
B.Send only Windows Security Events to Sentinel.
C.Send all logs to the Analytics logs table for full query capabilities.
D.Use Analytics logs for high-value security logs and Basic logs for verbose logs with low security value.
AnswerD

This tiered strategy optimizes both security visibility and cost by routing high-value, actionable security logs—such as authentication failures, privilege use, and security events—to Analytics logs where they support advanced KQL queries and alert rules. Simultaneously, verbose logs with low security value, like informational audit entries or diagnostic logs, are sent to Basic logs for occasional queries and compliance. This balances operational effectiveness with budget constraints, ensuring the SOC retains critical detection and investigation capabilities without paying premium analytics costs for every byte of log data.

Why this answer

It balances cost and query performance by routing high-value security logs (e.g., Windows Security Events, network logs) to the Analytics logs table for full KQL query capabilities and retention, while sending verbose, low-security-value logs (e.g., DNS debug, firewall flow logs) to the Basic logs table, which offers lower ingestion cost and limited query features (e.g., no KQL summarization). This tiered approach ensures analysts can efficiently hunt on critical data without incurring unnecessary costs for voluminous, less actionable logs.

Exam trap

The trap here is that candidates assume 'cost-effective' means using only the cheapest option (Basic logs) or only the most capable option (Analytics logs), failing to recognize that Microsoft Sentinel’s tiered ingestion model is designed specifically to optimize cost versus query capability by separating high-value and low-value log sources.

How to eliminate wrong answers

Option A is wrong because sending all logs to the Basic logs table would severely limit query capabilities—Basic logs support only simple search and no KQL aggregation functions like summarize or make-series—making threat hunting and advanced analytics impractical. Option B is wrong because sending only Windows Security Events ignores other critical sources like Azure Activity logs, network logs, and third-party security appliances, creating blind spots in the hybrid environment and violating the requirement to detect threats across all sources. Option C is wrong because sending all logs to the Analytics logs table would incur high ingestion and retention costs for verbose logs (e.g., DNS queries, firewall flow logs) that have low security value, contradicting the cost-effectiveness requirement.

Full explanation →
9
MCQmedium

You are designing an API management solution using Azure API Management. The security team requires that all API calls must be authenticated using OAuth 2.0 and that only specific Azure AD applications can access the APIs. Additionally, the solution must support rate limiting and IP filtering. What should you configure?

A.Set up client certificate authentication and map certificates to Azure AD apps
B.Enable API key authentication and restrict access using subscription keys
C.Use OAuth 2.0 with Azure AD and configure inbound policies to validate JWTs
D.Configure OAuth 2.0 in Azure API Management, use validate-jwt policy to restrict to specific Azure AD apps, and add rate-limit and ip-filter policies
AnswerD

This combination meets all requirements.

Why this answer

It fully addresses all requirements: it uses OAuth 2.0 with Azure AD for authentication, the 'validate-jwt' policy restricts access to specific Azure AD applications, and the 'rate-limit' and 'ip-filter' policies satisfy the rate limiting and IP filtering requirements. Option A is incorrect because client certificate authentication is not OAuth 2.0. Option B is incorrect because API key authentication is less secure and does not allow restricting to specific Azure AD apps.

Option C is incorrect because while it uses OAuth 2.0 and validate-jwt, it does not include the required rate limiting and IP filtering policies.

Full explanation →
10
MCQeasy

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. What should you configure?

A.Create a Conditional Access policy that requires compliant device
B.Set up enrollment restrictions in Intune
C.Create a device configuration policy that blocks non-compliant devices
D.Configure an app protection policy for email apps
AnswerA

Conditional Access policies are the access-control layer that evaluates the device's compliance state at sign-in. When combined with an Intune compliance policy, the 'Require device to be marked as compliant' grant control forces Azure AD to check the device's compliance status and block access if the device is non-compliant. This is the correct approach because it directly enforces the access requirement for corporate resources, unlike enrollment or configuration policies that only manage settings or enrollment.

Why this answer

A Conditional Access policy in Microsoft Entra ID (formerly Azure AD) can enforce the requirement that only devices marked as compliant by Intune can access corporate email. This policy evaluates the device compliance status at authentication time and blocks or grants access based on that signal, ensuring that only managed and compliant devices can connect to services like Exchange Online.

Exam trap

The trap here is that candidates often confuse device configuration policies (which set device settings) with Conditional Access (which enforces access control based on compliance), leading them to choose option C instead of the correct policy-based access control.

How to eliminate wrong answers

Option B is wrong because enrollment restrictions in Intune control which devices can enroll into management (e.g., by platform or ownership type), but they do not enforce compliance at the point of access to corporate email. Option C is wrong because device configuration policies in Intune are used to set settings and features on devices (like password policies or restrictions), not to block non-compliant devices from accessing resources; blocking access is done via Conditional Access. Option D is wrong because an app protection policy (MAM) protects data within apps (e.g., preventing copy/paste or requiring PIN) but does not evaluate device compliance; it can be used without device enrollment but does not replace the need for a Conditional Access policy that checks device compliance.

Full explanation →
11
MCQhard

Your organization uses Microsoft Defender for Cloud to secure multi-cloud workloads. You need to ensure that Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP) resources are assessed against the same security baseline. What should you do?

A.Configure AWS Config and GCP Security Command Center to export findings to Microsoft Sentinel
B.Connect AWS and GCP accounts to Defender for Cloud and use Azure Policy to enforce the Microsoft Cloud Security Benchmark
C.Use regulatory compliance standards for each cloud separately
D.Enable the Cloud Security Posture Management (CSPM) plan and configure AWS and GCP connectors
AnswerB

Connecting AWS and GCP accounts to Defender for Cloud surfaces those resources in Azure Resource Graph, where Azure Policy can apply the Microsoft Cloud Security Benchmark (MCSB), a unified initiative built on CIS/NIST plus Microsoft controls. This gives continuous compliance assessment and enforcement, like DeployIfNotExists remediation, across all clouds. As a result, every subscription or cloud account is measured against the same baseline, regardless of native cloud tooling—this is the only option that both centralizes and enforces a single baseline.

Why this answer

Microsoft Defender for Cloud's multi-cloud CSPM capabilities allow you to connect AWS and GCP accounts directly, and then apply Azure Policy to enforce the Microsoft Cloud Security Benchmark (MCSB) across all connected clouds. This ensures a unified security baseline assessment for Azure, AWS, and GCP resources, as MCSB is the default policy initiative in Defender for Cloud.

Exam trap

The trap here is that candidates confuse enabling the CSPM plan and connectors (Option D) with the complete solution, forgetting that a specific baseline policy (MCSB) must be assigned via Azure Policy to enforce the unified assessment.

How to eliminate wrong answers

Option A is wrong because exporting findings from AWS Config and GCP Security Command Center to Microsoft Sentinel is for centralized SIEM and threat detection, not for enforcing a unified security baseline across clouds. Option C is wrong because using separate regulatory compliance standards for each cloud would not enforce a single, consistent security baseline; it would result in fragmented assessments. Option D is wrong because enabling the CSPM plan and configuring connectors is a prerequisite step, but it does not by itself enforce a specific security baseline; you must also assign the Microsoft Cloud Security Benchmark policy via Azure Policy to achieve the stated goal.

Full explanation →
12
MCQhard

Your organization is implementing a privileged access strategy using Microsoft Entra Privileged Identity Management (PIM). The compliance team requires that all privileged role activations be approved by a manager and that an audit trail is maintained for at least one year. Which configuration should you recommend?

A.Configure access reviews for privileged roles
B.Set PIM role settings to require approval and enable audit logging
C.Enable Conditional Access policies for privileged roles
D.Require Azure MFA for role activation
AnswerB

PIM supports approval workflow and logs are retained for auditing.

Why this answer

It directly addresses both compliance requirements: requiring approval ensures a manager authorizes each activation, and enabling audit logging in PIM retains activation history for at least one year. PIM role settings allow you to configure approval workflows and automatically log all activations to the Microsoft Entra audit log, which can be exported and retained for compliance purposes.

Exam trap

The trap here is that candidates confuse access reviews (periodic recertification) with the real-time approval workflow required for each activation, or they assume MFA alone satisfies the audit and approval requirements.

How to eliminate wrong answers

Option A is wrong because access reviews are used for periodic recertification of role assignments, not for real-time approval of activations or audit trail retention. Option C is wrong because Conditional Access policies control access based on conditions like location or device state, but they do not provide the required manager approval workflow or dedicated audit logging for role activations. Option D is wrong because Azure MFA for role activation enhances security but does not satisfy the compliance requirement for manager approval or the one-year audit trail retention.

Full explanation →
13
MCQmedium

A company uses Microsoft Purview to manage data governance. They need to classify sensitive data automatically in Azure SQL Database. What should they configure?

A.Microsoft Defender for Cloud regulatory compliance
B.Microsoft Purview Data Map scanning rules
C.Microsoft Sentinel data connectors
D.Microsoft Entra ID Protection
AnswerB

Microsoft Purview Data Map scanning rules automatically connect to various data sources, both on-premises and multi-cloud, and run scans to profile and classify assets. These rules apply built-in or custom classification patterns—like regex for PII, financial, or health information—and assign sensitivity labels to structured and unstructured data. This is exactly the mechanism that enables data governance by building a searchable, classified inventory of enterprise data, making it the correct choice for a company using Purview.

Why this answer

Microsoft Purview Data Map scanning rules are the correct choice because they enable automated classification of sensitive data in Azure SQL Database by scanning the database schema and content against built-in or custom sensitive data types. This is the native mechanism within Purview to discover and label sensitive columns, such as credit card numbers or PII, directly in Azure SQL Database.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud's regulatory compliance dashboard with actual data classification, but Defender for Cloud only checks configuration settings against compliance frameworks, not the content of the data itself.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud regulatory compliance assesses the security posture of Azure resources against compliance standards (e.g., SOC 2, PCI DSS) but does not perform data classification or scanning of sensitive data within Azure SQL Database. Option C is wrong because Microsoft Sentinel data connectors ingest security logs and alerts from various sources for threat detection and SIEM purposes, not for scanning or classifying sensitive data in databases. Option D is wrong because Microsoft Entra ID Protection focuses on identity-based risks such as compromised credentials and sign-in anomalies, not on data classification within Azure SQL Database.

Full explanation →
14
Multi-Selecteasy

Which TWO Microsoft Purview solutions should you use to protect sensitive data in Microsoft 365? (Choose two.)

Select 2 answers
A.Microsoft Purview Audit.
B.Insider Risk Management.
C.Sensitivity labels and policies.
D.Microsoft Purview eDiscovery.
E.Data Loss Prevention (DLP) policies.
AnswersC, E

Labels classify and protect data with encryption and markings.

Why this answer

The correct answers are Sensitivity labels and policies (C) and Data Loss Prevention (DLP) policies (E). Sensitivity labels allow classification and protection of sensitive data at rest and in transit, while DLP policies help prevent unauthorized sharing of sensitive data. Option A (Audit) is incorrect because it only provides logging and monitoring, not direct data protection.

Option B (Insider Risk Management) is incorrect as it focuses on detecting risky user behavior but does not directly protect data. Option D (eDiscovery) is designed for legal discovery and does not protect data.

Full explanation →
15
MCQmedium

Your organization uses Microsoft Purview and needs to prevent users from copying sensitive data to USB drives. Which solution should you implement?

A.Sensitivity labels with encryption
B.Insider Risk Management
C.Endpoint data loss prevention (DLP)
D.Communication Compliance
AnswerC

Endpoint data loss prevention (Endpoint DLP) is the correct choice because it installs an agent on Windows and macOS endpoints that inspects data in real time as users interact with files. It can enforce policies to block the copying of sensitive items, such as those matching sensitive info types or trainable classifiers, to removable USB devices, and optionally show a policy tip to the user. This direct, pre-action enforcement provides the precise control needed to prevent data leakage via USB.

Why this answer

Endpoint DLP is the correct solution because it extends data loss prevention policies to endpoints, enabling the detection and blocking of sensitive data being copied to removable USB drives. Unlike other controls, Endpoint DLP can monitor and restrict data exfiltration actions at the device level, such as copying files to USB media, based on the content's sensitivity classification.

Exam trap

The trap here is that candidates often confuse Insider Risk Management (a detective control) with Endpoint DLP (a preventive control), assuming that risk management can block actions, when in fact it only alerts on suspicious behavior after the fact.

How to eliminate wrong answers

Option A is wrong because sensitivity labels with encryption protect data at rest and in transit by restricting access, but they do not block the act of copying labeled data to a USB drive; encryption alone does not prevent data exfiltration via removable media. Option B is wrong because Insider Risk Management is a detection and investigation tool that identifies risky user activities (e.g., unusual file copying) but does not actively block or prevent the copy action in real time. Option D is wrong because Communication Compliance focuses on monitoring and analyzing communications (e.g., email, Teams) for policy violations, not on controlling data movement to USB drives.

Full explanation →
16
Multi-Selectmedium

Which TWO of the following are valid methods to protect privileged accounts in Microsoft Entra ID?

Select 2 answers
A.Configure Conditional Access policies for privileged roles
B.Implement Privileged Identity Management (PIM)
C.Enable Identity Protection for all users
D.Enable Self-Service Password Reset (SSPR)
E.Use Azure AD Connect to sync privileged accounts
AnswersA, B

Conditional Access can enforce MFA and other controls for privileged roles.

Why this answer

Conditional Access policies can be configured to require stronger authentication, device compliance, or location-based controls specifically for users assigned to privileged roles (e.g., Global Administrator, Privileged Role Administrator). This directly protects privileged accounts by enforcing additional security requirements before granting access to Entra ID resources.

Exam trap

The trap here is that candidates often confuse general security features (like Identity Protection or SSPR) with dedicated privileged account protection mechanisms, failing to recognize that only PIM and Conditional Access policies for privileged roles directly control and restrict privileged access in Entra ID.

Full explanation →
17
MCQhard

A company uses Azure DevOps and wants to implement a DevSecOps practice by scanning code for secrets and vulnerabilities before deployment. Which tool should they integrate into their pipeline?

A.Azure Policy
B.Microsoft Purview
C.GitHub Advanced Security
D.Microsoft Defender for DevOps
AnswerD

Microsoft Defender for DevOps is a dedicated service that integrates directly with Azure DevOps (and GitHub) to provide continuous security scanning of code, secrets, infrastructure-as-code templates, and open-source dependencies. It leverages built-in scanners like Credential Scanner and integrates with Defender for Cloud to aggregate findings across the software development life cycle. This makes it the correct choice for an Azure DevOps-centric organization seeking DevOpsSec capabilities.

Why this answer

Microsoft Defender for DevOps is the correct choice because it is a unified DevSecOps solution that integrates directly into Azure DevOps pipelines to scan code for secrets, vulnerabilities, and open-source dependencies before deployment. It provides actionable security insights and remediation guidance, aligning with the requirement to implement a DevSecOps practice by scanning code for secrets and vulnerabilities.

Exam trap

The trap here is that candidates may confuse GitHub Advanced Security (which is for GitHub repositories) with Microsoft Defender for DevOps (which is for Azure DevOps pipelines), leading them to choose Option C even though the question explicitly states the company uses Azure DevOps.

How to eliminate wrong answers

Option A is wrong because Azure Policy is a governance tool that enforces compliance rules on Azure resources (e.g., tagging, location restrictions) and does not scan code for secrets or vulnerabilities. Option B is wrong because Microsoft Purview is a data governance and classification service for data estates (e.g., sensitive data discovery in storage) and lacks the capability to scan source code in a CI/CD pipeline. Option C is wrong because GitHub Advanced Security is a suite of security features for GitHub repositories (e.g., secret scanning, code scanning) but is not natively integrated into Azure DevOps pipelines; it requires a GitHub repository, whereas the question specifies Azure DevOps.

Full explanation →
18
MCQeasy

You are designing a security solution for Azure resources. You need to ensure that any changes to network security groups (NSGs) are automatically logged and sent to a central Log Analytics workspace. Which Azure feature should you use?

A.Diagnostic settings on the Azure Activity Log
B.Azure Policy
C.NSG flow logs
D.Azure Monitor alerts
AnswerA

Diagnostic settings on the Azure Activity Log are the correct mechanism because the Activity Log itself records every control-plane operation—such as resource creation, deletion, and configuration changes—for your Azure resources. By configuring a diagnostic setting on this log, you can stream those management events directly into a Log Analytics workspace, enabling centralized querying, alerting, and long-term retention for security auditing. This is the built-in, supported way to capture and route resource-level change activity to your security monitoring pipeline.

Why this answer

Diagnostic settings on the Azure Activity Log capture all control-plane operations, including changes to NSGs (e.g., rule additions or deletions). By configuring a diagnostic setting to stream the Activity Log to a Log Analytics workspace, you ensure that every NSG modification is automatically logged and centralized for monitoring and alerting.

Exam trap

The trap here is confusing NSG flow logs (which log network traffic) with the Activity Log (which logs configuration changes), leading candidates to select NSG flow logs instead of diagnostic settings on the Activity Log.

How to eliminate wrong answers

Option B (Azure Policy) is wrong because Azure Policy enforces compliance rules (e.g., preventing NSG changes that allow all inbound traffic) but does not automatically log changes; it can trigger remediation but not send logs to Log Analytics. Option C (NSG flow logs) is wrong because NSG flow logs capture IP traffic data (source/destination, ports, protocols) through the NSG, not configuration changes to the NSG itself. Option D (Azure Monitor alerts) is wrong because alerts are reactive notifications based on log data or metrics; they do not capture or forward logs themselves.

Full explanation →
19
MCQeasy

You are designing a security operations strategy for Microsoft 365. You need to prioritize alerts from Microsoft Defender XDR based on their impact on business operations. Which security best practice should you follow?

A.Prioritize alerts based on a risk assessment that considers asset criticality, threat severity, and business impact
B.Prioritize alerts based on a qualitative risk assessment only
C.Treat all alerts with equal severity to ensure none are missed
D.Prioritize alerts based solely on the MITRE ATT&CK technique involved
AnswerA

Risk-based prioritization that scores asset criticality, threat severity, and business impact is the industry-standard approach because it translates raw signals into actionable decisions aligned with organizational value. By quantifying each alert's potential damage against the importance of the affected system, security operations teams can focus containment and investigation resources on events most likely to cause significant harm. This method also supports continuous improvement by allowing thresholds to be tuned based on telemetry and incident outcomes.

Why this answer

Microsoft Defender XDR integrates with Microsoft 365 Defender's risk-based alert prioritization, which uses a combination of asset criticality (e.g., from Microsoft Purview or Defender for Cloud Apps), threat severity (e.g., from the Microsoft Defender portal's alert severity levels: Informational, Low, Medium, High), and business impact (e.g., via sensitivity labels or data classification). This aligns with the security best practice of risk-based alert triage, ensuring that high-impact alerts are addressed first to minimize business disruption.

Exam trap

The trap here is that candidates may choose Option D because MITRE ATT&CK is a common framework in security operations, but they overlook that Microsoft Defender XDR's prioritization engine uses a multi-faceted risk assessment (including asset criticality and business impact) rather than a single technique-based filter.

How to eliminate wrong answers

Option B is wrong because a qualitative risk assessment alone lacks the quantitative data (e.g., asset criticality scores, threat severity levels) that Microsoft Defender XDR uses to dynamically prioritize alerts, leading to subjective and inconsistent triage. Option C is wrong because treating all alerts with equal severity ignores the risk-based prioritization built into Microsoft Defender XDR, which uses machine learning and threat intelligence to assign different severity levels (e.g., High, Medium, Low) and would overwhelm security operations with noise. Option D is wrong because prioritizing solely on the MITRE ATT&CK technique ignores asset criticality and business impact; for example, a low-severity technique on a critical server may be more impactful than a high-severity technique on a non-critical endpoint, and Microsoft Defender XDR's alert enrichment includes asset context beyond just the technique.

Full explanation →
20
MCQeasy

A company is adopting Microsoft Purview for data security. They need to prevent users from sharing sensitive data like credit card numbers via email. Which feature should you configure?

A.Audit log search
B.Data Loss Prevention (DLP) policy
C.Insider Risk Management policy
D.Sensitivity labels
AnswerB

Data Loss Prevention (DLP) policies in Microsoft Purview are the correct inline control to block sharing of sensitive information. They use built-in sensitive info types (e.g., credit card numbers, personally identifiable information) and trainable classifiers to evaluate content in real time, then enforce actions such as 'Block' with the option to allow overrides for Exchange, SharePoint, OneDrive, and endpoints. By applying conditions like 'sharing with people outside the organization,' DLP can prevent the sharing action before any data leaves the tenant, making it the only option here that directly provides ex-ante prevention rather than detection or classification.

Why this answer

Data Loss Prevention (DLP) policies in Microsoft Purview are specifically designed to detect and prevent the accidental or intentional sharing of sensitive information, such as credit card numbers, through email and other channels. By configuring a DLP policy with a rule that scans for credit card number patterns (using predefined or custom sensitive info types), the system can block, quarantine, or notify users when such data is sent via Exchange Online. This directly addresses the requirement to prevent sharing sensitive data via email.

Exam trap

The trap here is that candidates often confuse Sensitivity labels as a direct replacement for DLP, but labels are for classification and protection (e.g., encryption), not for real-time content inspection and blocking of specific data patterns like credit card numbers in email.

How to eliminate wrong answers

Option A is wrong because Audit log search is a forensic tool for reviewing past activities, not a preventive control that blocks data sharing in real time. Option C is wrong because Insider Risk Management policies focus on identifying and investigating risky user behaviors (e.g., data exfiltration patterns) rather than enforcing content-based restrictions on outbound email. Option D is wrong because Sensitivity labels classify and protect data through encryption and visual markings, but they do not inherently block the transmission of specific sensitive data types like credit card numbers via email without being combined with a DLP policy.

Full explanation →
21
MCQeasy

Tailwind Traders is a small business that uses Microsoft 365 Business Premium. They have no dedicated IT staff. The owner wants to implement basic security measures to protect against common threats like phishing, ransomware, and unauthorized access. They need a simple, cost-effective solution that aligns with Microsoft's security best practices for small businesses. Which set of actions should you recommend?

A.Implement Privileged Identity Management (PIM) for all accounts. Use Azure Information Protection to classify all emails. Set up a SIEM using Microsoft Sentinel.
B.Deploy Microsoft Intune to manage devices. Configure Conditional Access policies to require compliant devices. Use Microsoft Defender for Endpoint for antivirus. Set up a VPN for remote access.
C.Purchase Azure AD Premium P2 for all users. Use Identity Protection to detect risks. Configure Conditional Access with session controls. Use Azure AD Identity Governance for access reviews.
D.Enable Security Defaults in Microsoft Entra ID to enforce MFA for all users. Configure Microsoft Defender for Office 365 to protect against phishing and malware. Use Microsoft Defender for Business (included) for endpoint protection. Regularly review the Microsoft 365 Secure Score and implement top recommendations.
AnswerD

Security Defaults in Microsoft Entra ID automatically enforce MFA for all users and block legacy authentication, providing a strong baseline without extra licensing or complex policy setup. Defender for Office 365 protects against phishing, malware, and malicious links in email, which is critical for small businesses that rely heavily on email communication. Defender for Business is included in Microsoft 365 Business plans and provides managed endpoint protection tailored to smaller organizations. Regularly reviewing the Secure Score helps prioritize low-effort, high-impact security improvements that align with the business's actual risk profile.

Why this answer

It aligns with Microsoft's security best practices for small businesses with no dedicated IT staff. Security Defaults in Microsoft Entra ID provide a baseline of MFA enforcement without requiring complex configuration. Microsoft Defender for Office 365 and Defender for Business (included in Microsoft 365 Business Premium) offer integrated phishing, malware, and endpoint protection.

Regularly reviewing the Secure Score ensures continuous improvement against common threats like ransomware and unauthorized access.

Exam trap

The trap here is that candidates often over-engineer the solution by selecting advanced identity or endpoint management options (like PIM, Intune, or Azure AD Premium P2) that are technically valid but inappropriate for a small business with no IT staff, ignoring the cost and complexity constraints explicitly stated in the scenario.

How to eliminate wrong answers

Option A is wrong because Privileged Identity Management (PIM) requires Azure AD Premium P2 licensing, which is not included in Microsoft 365 Business Premium and adds unnecessary complexity for a small business with no IT staff; Azure Information Protection and Microsoft Sentinel are also overkill and not cost-effective. Option B is wrong because Microsoft Intune requires additional licensing beyond Business Premium and managing device compliance via Conditional Access policies demands dedicated IT expertise; a VPN is not a core security control for phishing or ransomware and adds complexity. Option C is wrong because Azure AD Premium P2 for all users is expensive and unnecessary for a small business; Identity Protection and Identity Governance are advanced features designed for larger enterprises with dedicated identity teams, not a simple, cost-effective baseline.

Full explanation →
22
Multi-Selecteasy

Your organization uses Microsoft Purview Information Protection to label sensitive emails. You need to ensure that labels are applied automatically based on content. Which THREE methods can you use?

Select 3 answers
A.Manual labeling by users
B.File plan (for records management)
C.Sensitive information types
D.Auto-labeling policies in Microsoft Purview
E.Trainable classifiers
AnswersC, D, E

Sensitive info types detect data like credit cards for automatic labeling.

Why this answer

Sensitive information types (C) are predefined or custom patterns that detect sensitive data such as credit card numbers or social security numbers, enabling automatic label application. Auto-labeling policies in Microsoft Purview (D) apply labels automatically to emails and files based on conditions like sensitive information types or trainable classifiers. Trainable classifiers (E) use machine learning to identify content patterns and automatically apply labels without requiring explicit pattern definitions.

Exam trap

The trap here is that candidates may confuse manual labeling or records management tools (like file plans) with automatic content-based labeling mechanisms, but only sensitive information types, auto-labeling policies, and trainable classifiers directly support automatic label application based on content analysis.

Full explanation →
23
Multi-Selectmedium

Which TWO actions should you take to implement a zero-trust identity strategy in Microsoft Entra ID?

Select 2 answers
A.Enable single sign-on for all applications
B.Require multi-factor authentication for all users
C.Implement passwordless authentication for all users
D.Synchronize all on-premises identities to the cloud
E.Configure Conditional Access policies based on user risk and device compliance
AnswersB, E

MFA is a key zero-trust principle.

Why this answer

For a zero-trust identity strategy in Microsoft Entra ID, requiring multi-factor authentication (MFA) for all users (option B) is a fundamental control to verify identity. Configuring Conditional Access policies based on user risk and device compliance (option E) enforces adaptive, context-aware access. Option A (single sign-on) improves user experience but does not directly enforce zero-trust.

Option C (passwordless authentication) enhances security but is not a specific zero-trust action; MFA is more critical. Option D (synchronizing identities) supports hybrid scenarios but does not advance zero-trust principles.

Full explanation →
24
MCQeasy

Your organization needs to audit all changes to Azure resources, including who made the change and what was changed. Which Azure service should you use to collect and analyze this audit data?

A.Azure Policy
B.Azure Monitor with activity logs
C.Microsoft Defender for Cloud
D.Microsoft Sentinel
AnswerB

The Azure Activity Log records every control-plane write operation (create, update, delete) on Azure resources, including the caller identity, timestamp, operation name, and resource ID—precisely the data required for change auditing. Azure Monitor provides a unified platform to query and analyze these logs via Log Analytics, configure alerts on specific changes, and export them to storage or event hubs for retention. This combination yields a comprehensive, queryable audit trail of all resource modifications, making it the correct foundational service for auditing every change to Azure resources.

Why this answer

Azure Monitor with activity logs is the correct service because it captures all control-plane operations on Azure resources, including who performed the change (via Azure Active Directory authentication), what was changed (the resource and properties), and when it occurred. Activity logs are retained for 90 days by default and can be exported to Log Analytics workspaces for advanced querying and alerting, making them the native audit trail for Azure resource modifications.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel as the audit service because it is a SIEM, but Sentinel ingests logs from other sources (including activity logs) and is not the native collection mechanism; the question specifically asks for the service that collects and analyzes the audit data, which is Azure Monitor with activity logs.

How to eliminate wrong answers

Option A is wrong because Azure Policy is a governance tool that enforces compliance rules on resources (e.g., requiring specific tags or denying certain SKUs) and does not natively log who made changes or what was changed; it evaluates resource configurations against policies but does not provide an audit trail of modifications. Option C is wrong because Microsoft Defender for Cloud focuses on security posture management, threat detection, and vulnerability assessments, not on auditing all resource changes; it uses activity logs for some security alerts but is not designed as a primary audit log service. Option D is wrong because Microsoft Sentinel is a SIEM (Security Information and Event Management) solution that ingests logs from multiple sources, including activity logs, but it is not the service that collects the audit data itself; the underlying source for resource change auditing remains Azure Monitor activity logs.

Full explanation →
25
MCQeasy

Your organization uses Microsoft Sentinel and wants to automatically respond to high-severity incidents. Which feature should you configure?

A.Configure an automation rule to run a playbook automatically
B.Create a playbook and run it manually for each incident
C.Set up an analytics rule with automatic response
D.Use a workbook to trigger a playbook
AnswerA

Automation rules in Microsoft Sentinel are event-driven orchestration mechanisms that evaluate newly created or updated incidents against configured conditions—such as severity or name—and then execute one or more linked playbooks automatically. Playbooks are Azure Logic Apps that can perform remediation steps like isolation, data collection, or notification, ensuring consistent, immediate response without human involvement. This is the only approach listed that satisfies 'automatically' while honoring incident context, since automation rules trigger exactly when incidents are created or changed.

Why this answer

Automation rules in Microsoft Sentinel allow you to define automated responses that trigger when an incident is created or updated, including running playbooks (Azure Logic Apps workflows) automatically. This is the correct approach for automatically responding to high-severity incidents because it eliminates manual intervention and ensures consistent, immediate action based on incident properties like severity.

Exam trap

The trap here is confusing analytics rule automated responses (which run on alerts before incident creation) with automation rules (which run on incidents after creation), leading candidates to incorrectly select Option C for incident-level automation.

How to eliminate wrong answers

Option B is wrong because running a playbook manually for each incident defeats the purpose of automation and does not scale for high-severity incidents that require immediate response. Option C is wrong because analytics rules generate alerts, not incidents, and while they can have automated responses, those responses run on alerts before incidents are created; for incident-level automated response, you need automation rules. Option D is wrong because workbooks are visualization and reporting tools, not triggers for playbooks; they cannot initiate automated response actions.

Full explanation →
26
MCQeasy

Your organization is adopting Microsoft Entra ID as the identity provider for all SaaS applications. The security team wants to enforce multifactor authentication (MFA) for all users accessing these applications. Which approach aligns with security best practices and minimizes user friction?

A.Enable per-user MFA for all users in Microsoft Entra ID.
B.Disable MFA and rely on strong password policies.
C.Enable Microsoft Entra ID Security defaults.
D.Create a Conditional Access policy requiring MFA for all cloud apps, excluding trusted locations and devices.
AnswerD

A Conditional Access policy gives granular control to require MFA for all cloud apps while excluding trusted locations and devices, enabling risk-based, context-aware enforcement. It can leverage named locations, device compliance, and sign-in risk, and integrate with session controls, session persistence, and break-glass accounts, directly satisfying both the MFA mandate and the need for exception handling.

Why this answer

Conditional Access policies allow granular, risk-based MFA enforcement that excludes trusted locations (e.g., corporate offices) and trusted devices (e.g., compliant or hybrid-joined devices). This aligns with the Zero Trust principle of 'verify explicitly' while minimizing user friction by not prompting for MFA when the user is already in a trusted context. Security defaults (Option C) enforce MFA for all users but lack the ability to exclude trusted locations or devices, which can cause unnecessary friction.

Exam trap

The trap here is that candidates often confuse Security defaults (Option C) as the best practice for MFA enforcement, but Security defaults lack the exclusion capabilities of Conditional Access, which is the recommended approach for minimizing friction while maintaining security.

How to eliminate wrong answers

Option A is wrong because per-user MFA is a legacy approach that forces MFA on every authentication attempt regardless of context, leading to high user friction and no ability to exclude trusted locations or devices; it also lacks the granular control of Conditional Access. Option B is wrong because disabling MFA and relying solely on strong password policies violates security best practices, as passwords alone are vulnerable to phishing, credential stuffing, and brute-force attacks, and does not meet the requirement to enforce MFA. Option C is wrong because while Security defaults enforce MFA for all users, they do not allow exclusion of trusted locations or devices, which means users are prompted for MFA even from the corporate network or on compliant devices, increasing friction unnecessarily.

Full explanation →
27
MCQhard

Your organization uses Microsoft Defender for Cloud Apps. You need to detect and block data exfiltration from sanctioned cloud apps to personal devices. What should you configure?

A.Create an OAuth app policy to revoke permissions.
B.Create an app discovery policy to identify unsanctioned apps.
C.Create a file policy to detect sensitive data in sanctioned apps.
D.Create a session policy with app governance to block download.
AnswerD

Session policies can block data exfiltration in real time.

Why this answer

A session policy with app governance in Microsoft Defender for Cloud Apps allows you to monitor and control user activities in real time. By configuring a session policy to block downloads, you can prevent data exfiltration from sanctioned cloud apps to personal devices, as the policy inspects HTTP/HTTPS traffic and enforces access controls based on user context and device compliance.

Exam trap

The trap here is that candidates often confuse file policies (which detect sensitive data after it is stored) with session policies (which prevent exfiltration in real time), leading them to choose Option C instead of D.

How to eliminate wrong answers

Option A is wrong because an OAuth app policy revokes permissions for third-party apps that have been granted access to cloud app data, but it does not control user download actions from sanctioned apps to personal devices. Option B is wrong because an app discovery policy identifies and monitors unsanctioned cloud apps in the environment, but it does not block data exfiltration from already sanctioned apps. Option C is wrong because a file policy detects sensitive data within sanctioned apps and can trigger alerts or automated actions, but it does not block downloads in real time; it is reactive rather than preventive.

Full explanation →
28
MCQmedium

A company uses Microsoft Intune to manage devices. They want to ensure that only devices that have passed health attestation can access corporate email. Which method should they use?

A.Use Microsoft Defender for Endpoint to block devices that fail health attestation
B.Create a device compliance policy for health attestation and use Conditional Access to require compliant devices
C.Create an app protection policy to require device health attestation
D.Create a device configuration policy to enforce health attestation
AnswerB

Device compliance policies in Microsoft Intune include a 'Device Health Attestation' section that reports security boot, BitLocker, and code integrity state from supported Windows devices. After the policy is evaluated, Conditional Access can require 'Device to be marked as compliant' as a grant control, preventing sign-in from devices that fail attestation checks. This pairing is the correct sequence: Intune establishes the health baseline and Conditional Access enforces access, making it the only option here that actually gates authentication.

Why this answer

It combines a device compliance policy that evaluates health attestation (e.g., BitLocker status, Secure Boot, code integrity) with a Conditional Access policy that grants access to corporate email only when the device is marked as compliant. This is the standard Microsoft approach for enforcing health attestation before granting access to cloud resources like Exchange Online.

Exam trap

The trap here is confusing device compliance policies (which evaluate and report health state) with device configuration policies (which only apply settings), leading candidates to pick Option D, which cannot enforce access control.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Endpoint can detect and alert on device health issues but cannot directly block access to corporate email; blocking requires integration with Conditional Access or a network enforcement point. Option C is wrong because app protection policies (MAM) manage data protection at the app level without evaluating device health attestation; they rely on app-level conditions like jailbreak detection, not hardware-attested health. Option D is wrong because device configuration policies set settings (e.g., BitLocker enablement) but do not enforce real-time attestation checks or block access; compliance is determined by a separate compliance policy, not a configuration profile.

Full explanation →
29
MCQhard

A company is designing a security strategy for their AI-powered applications using Microsoft Azure OpenAI Service. They need to ensure that the AI models are not used to generate harmful content and that the data sent to the models is protected. Which Microsoft Purview feature should they use?

A.Microsoft Purview Endpoint DLP
B.Microsoft Purview Information Protection
C.Microsoft Purview Data Loss Prevention (DLP) for AI
D.Microsoft Purview Audit
AnswerC

Microsoft Purview Data Loss Prevention (DLP) for AI extends DLP policies to AI services, allowing administrators to detect sensitive information—like financial, health, or personal data—within user prompts and AI-generated responses. It can enforce real-time actions such as blocking or warning users when sensitive data is exchanged, and it integrates with services like Microsoft Copilot. This makes it the only option that actively prevents harmful content from being processed or generated in AI interactions.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) for AI is the correct feature because it is specifically designed to monitor and control the data sent to and from AI applications, including Azure OpenAI Service, to prevent the generation of harmful content and protect sensitive data. It uses deep content analysis and policy-based controls to detect and block policy violations in real-time, directly addressing the dual requirements of content safety and data protection.

Exam trap

The trap here is that candidates often confuse general data protection features (like Information Protection or Endpoint DLP) with the specialized AI-focused DLP capability, assuming any DLP or protection feature can handle AI workloads, when only DLP for AI is purpose-built for Azure OpenAI Service interactions.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Endpoint DLP focuses on monitoring and controlling data on endpoints (e.g., Windows 10/11 devices) and does not natively integrate with Azure OpenAI Service to inspect AI model prompts or outputs. Option B is wrong because Microsoft Purview Information Protection is primarily for classifying, labeling, and protecting sensitive data at rest (e.g., files and emails) using encryption and rights management, not for real-time content filtering of AI interactions. Option D is wrong because Microsoft Purview Audit provides logging and investigation of user and admin activities (e.g., who accessed what) but does not enforce policies to prevent harmful content generation or protect data in transit to AI models.

Full explanation →
30
MCQmedium

Your organization uses Microsoft Entra ID and plans to implement a custom line-of-business application that accesses Microsoft Graph APIs. The application will be used by employees and external partners. You need to ensure that the application can authenticate users and obtain appropriate permissions without exposing the client secret. What should you implement?

A.Use a system-assigned managed identity to authenticate to Microsoft Graph.
B.Implement OAuth 2.0 authorization code flow with PKCE.
C.Store the client secret in Azure Key Vault and retrieve it at runtime.
D.Register the application as a public client and use the implicit grant flow.
AnswerB

The OAuth 2.0 authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended approach for native, mobile, and single-page applications that need to call Microsoft Graph. It first obtains an authorization code, which is then exchanged for tokens, and PKCE adds a cryptographically random code verifier that prevents authorization code interception or replay attacks. This flow eliminates the need for a client secret, making it secure for public clients while providing full support for refresh tokens and user consent.

Why this answer

The application is a line-of-business app used by employees and external partners, which implies it may be a public client (e.g., mobile or desktop) that cannot securely store a client secret. OAuth 2.0 authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended authentication pattern for such clients because it eliminates the need for a client secret by using a dynamically generated code verifier. This ensures the client secret is never exposed.

Option B is correct. Option A (system-assigned managed identity) is only suitable for Azure-hosted services, not client applications. Option C (storing client secret in Key Vault) still requires secret retrieval at runtime, which can be insecure for public clients.

Option D (implicit grant flow) is outdated and less secure than authorization code flow with PKCE.

Full explanation →
31
MCQhard

Your organization uses Microsoft Intune to manage devices and wants to ensure that only compliant devices can access corporate email. Which conditional access policy setting should you configure?

A.Require device to be marked as compliant
B.Require approved client app
C.Require Multi-Factor Authentication
D.Require domain join
AnswerA

The 'Require device to be marked as compliant' grant control is correct because Intune compliance policies evaluate the device's configuration, health, and security posture. In Conditional Access, this control blocks access unless the device meets the specific compliance criteria defined in Intune, such as encryption, patch level, and threat detection. It ensures a device-level trust boundary before granting access to corporate resources, making it the appropriate device compliance control.

Why this answer

The 'Require device to be marked as compliant' setting in a Conditional Access policy enforces that only devices meeting your Intune compliance policies (e.g., encryption, OS version, threat level) can access corporate email. This setting checks the device's compliance status reported by Intune to Azure AD during authentication, blocking non-compliant devices before they reach Exchange Online.

Exam trap

The trap here is that candidates often confuse 'Require approved client app' (which controls app-level access) with device compliance, thinking that restricting the app is sufficient to secure email, but it does not enforce device health or configuration.

How to eliminate wrong answers

Option B is wrong because 'Require approved client app' controls which client applications (e.g., Outlook mobile, Teams) can access data, not the device's compliance state; it does not enforce device health or configuration. Option C is wrong because 'Require Multi-Factor Authentication' adds an authentication factor but does not evaluate device compliance; a compromised but MFA-enabled device could still access email. Option D is wrong because 'Require domain join' is for Windows devices joined to on-premises Active Directory, not for mobile or BYOD devices managed by Intune; it does not check Intune compliance policies.

Full explanation →
32
Multi-Selecthard

Which THREE capabilities does Microsoft Purview provide for compliance management?

Select 3 answers
A.Identity protection and risk detection
B.Information protection with sensitivity labels
C.Data classification and labeling
D.Endpoint detection and response
E.eDiscovery and audit
AnswersB, C, E

Purview provides sensitivity labels.

Why this answer

Microsoft Purview provides compliance management capabilities including information protection with sensitivity labels, which allow organizations to classify and protect sensitive data across Microsoft 365 services, endpoints, and third-party apps. Sensitivity labels enforce encryption, visual markings, and access restrictions based on policy, directly supporting data loss prevention and governance.

Exam trap

The trap here is that candidates confuse Microsoft Purview's compliance-focused capabilities (like eDiscovery, audit, and sensitivity labels) with security operations tools (like identity protection and endpoint detection), which belong to separate Microsoft 365 security solutions.

Full explanation →
33
MCQmedium

A company is designing a secure API for a customer-facing application that will handle sensitive personal data. They need to ensure that only authorized client applications can call the API and that the identity of the end-user is verified. Which of the following should they implement?

A.HTTP Basic Authentication
B.OAuth 2.0 with client credentials and OpenID Connect
C.JWT bearer tokens
D.API keys
AnswerB

OAuth 2.0 with client credentials grant authenticates the client application, and OpenID Connect adds user authentication, ensuring both the client app and the end-user are verified.

Why this answer

OAuth 2.0 with client credentials grant authenticates the client application, while OpenID Connect extends OAuth 2.0 to verify the end-user's identity. Together, they satisfy both requirements: only authorized clients can call the API and the end-user's identity is confirmed. Option A (HTTP Basic Authentication) transmits credentials in plaintext and does not support user identity verification beyond the client.

Option C (JWT bearer tokens) is a token format, not a full authentication protocol; it lacks client authentication and user verification on its own. Option D (API keys) only authenticate the client, not the user, and are typically used for simple access control.

Full explanation →
34
Multi-Selecteasy

A company wants to secure its Azure Kubernetes Service (AKS) cluster. They need to ensure that pods cannot communicate with each other unless explicitly allowed, and that secrets are encrypted at rest. Which TWO security controls should they implement?

Select 2 answers
A.Use Azure Key Vault with Secrets Store CSI driver for secret management.
B.Apply Azure Policy to restrict container image sources.
C.Define Kubernetes network policies to restrict pod-to-pod traffic.
D.Enable Container insights for monitoring.
E.Enable Azure AD integration for the AKS cluster.
AnswersA, C

Azure Key Vault with the Secrets Store CSI driver securely injects secrets as mounted volumes, using the Kubernetes CSI interface. It stores secret material in Azure Key Vault—encrypted at rest with managed keys—while pods access it via managed identities or workload identity, eliminating the need to bake secrets into images, etcd, or environment variables. This provides robust secret management, including rotation and audit logging.

Why this answer

Correct answers: A and C. Network policies in Kubernetes can restrict pod-to-pod communication, and Azure Key Vault with CSI driver allows secrets to be encrypted and stored externally. Option B is incorrect: Azure Policy can enforce image source restrictions, but that does not address pod communication or secret encryption.

Option D is incorrect: Container insights is for monitoring, not for network restrictions or encryption. Option E is incorrect: Azure AD integration is for authentication, not for network or encryption.

Full explanation →
35
MCQmedium

A company is implementing a Zero Trust network strategy using Azure Virtual Network Manager (AVNM). They need to ensure that all traffic between virtual networks is encrypted and inspected by a firewall. Which configuration should they use?

A.Enable VNet peering between all VNets and use network security groups
B.Use a mesh topology with direct connectivity between VNets
C.Use a hub-and-spoke topology with a firewall appliance in the hub
D.Configure service endpoints for each VNet
AnswerC

Hub-and-spoke with firewall ensures traffic is routed through the firewall for inspection.

Why this answer

In a Zero Trust network strategy, all traffic must be encrypted and inspected regardless of source. A hub-and-spoke topology with a firewall appliance in the hub forces all inter-VNet traffic through the firewall, enabling deep packet inspection and encryption enforcement. Azure Virtual Network Manager (AVNM) can deploy this topology and route traffic via the hub, ensuring no direct VNet-to-VNet communication bypasses inspection.

Exam trap

The trap here is that candidates often assume VNet peering with NSGs is sufficient for Zero Trust, but NSGs cannot inspect or encrypt traffic, and peering itself does not enforce inspection—only a hub-and-spoke topology with a firewall appliance can meet both encryption and inspection requirements.

How to eliminate wrong answers

Option A is wrong because VNet peering creates direct, unencrypted-by-default connectivity between VNets, and network security groups (NSGs) only provide stateful filtering at Layers 3-4, not encryption or deep packet inspection. Option B is wrong because a mesh topology with direct connectivity between VNets allows traffic to bypass any central inspection point, violating the Zero Trust requirement that all traffic must be inspected. Option D is wrong because service endpoints provide private connectivity to Azure PaaS services over the Microsoft backbone, but they do not encrypt or inspect traffic between VNets.

Full explanation →
36
MCQmedium

Your company uses Microsoft Purview to classify and label sensitive data. The data protection team needs to automatically apply a 'Confidential' label to documents that contain a custom sensitive info type for employee IDs. Which should you create?

A.A trainable classifier
B.A sensitivity label
C.A retention label
D.A custom sensitive information type and an auto-labeling policy
AnswerD

A custom sensitive information type (SIT) lets you define a precise regex or keyword-based pattern for the employee ID, giving Purview deterministic detection logic for that exact structure. An auto-labeling policy then continuously scans documents in SharePoint, OneDrive, and Exchange for that SIT and automatically applies a sensitivity label when matches are found. Together, these two components provide end-to-end, content-based discovery and labeling — the correct combination for classifying files based on a custom employee ID pattern.

Why this answer

To automatically apply a 'Confidential' label based on the presence of a custom sensitive info type (employee IDs), you need both a custom sensitive information type (SIT) to define the pattern and an auto-labeling policy to trigger the label application. The auto-labeling policy uses the SIT to scan documents and automatically applies the specified sensitivity label when a match is found. This is the only option that combines the detection mechanism with automated labeling.

Exam trap

The trap here is that candidates often confuse the role of a sensitivity label (which is just the label definition) with the auto-labeling policy (which provides the detection and automation), leading them to select only the sensitivity label without the necessary policy.

How to eliminate wrong answers

Option A is wrong because a trainable classifier uses machine learning to identify content based on examples, not a custom pattern like employee IDs, and it cannot directly apply labels without an auto-labeling policy. Option B is wrong because a sensitivity label alone defines the label and its protection settings but does not include the detection logic or automation to apply it automatically based on content. Option C is wrong because a retention label is used for data lifecycle management (retention and deletion), not for sensitivity classification or automatic application based on sensitive info types.

Full explanation →
37
MCQmedium

A company uses Microsoft Defender for Cloud to manage security across hybrid workloads. They need to ensure that all Azure VMs have guest-level threat detection enabled. Which security policy should they assign?

A.Azure Security Benchmark
B.Microsoft cloud security benchmark
C.Microsoft Defender for Cloud Apps
D.NIST SP 800-53
AnswerB

The Microsoft cloud security benchmark (MCSB) is the unified, built-in policy initiative that evolved from the Azure Security Benchmark and includes policies that deploy the Guest Configuration extension onto VMs and enable Microsoft Defender for Servers, which provides guest-level threat detection. When this initiative is assigned, its DeployIfNotExists policies automatically install required agents and extensions, directly fulfilling the stated requirement. Thus, it is the correct initiative for enabling guest-level threat detection.

Why this answer

The Microsoft cloud security benchmark (MCSB) is the correct policy because it includes built-in guest-level threat detection recommendations for Azure VMs, such as deploying the Log Analytics agent and enabling Microsoft Defender for Servers with guest-level monitoring. This benchmark is the default initiative in Defender for Cloud and directly maps to the requirement of enabling guest-level threat detection across all VMs.

Exam trap

The trap here is that candidates confuse the deprecated 'Azure Security Benchmark' with the current 'Microsoft cloud security benchmark' or mistakenly think a compliance framework like NIST SP 800-53 can be directly assigned as a security policy in Defender for Cloud to enable technical controls like guest-level threat detection.

How to eliminate wrong answers

Option A is wrong because the Azure Security Benchmark is the predecessor to the Microsoft cloud security benchmark and has been deprecated; it does not include the specific guest-level threat detection policies required for this scenario. Option C is wrong because Microsoft Defender for Cloud Apps is a CASB (Cloud Access Security Broker) for SaaS applications, not a security policy for enabling guest-level threat detection on Azure VMs. Option D is wrong because NIST SP 800-53 is a compliance framework from the U.S.

National Institute of Standards and Technology, not a security policy initiative in Defender for Cloud that can be assigned to enable guest-level threat detection.

Full explanation →
38
MCQmedium

A company uses Microsoft 365 Defender to protect their endpoints, email, and identities. They want to create a custom detection for a specific behavior that is not covered by built-in detections. Which tool should they use?

A.Microsoft Sentinel analytics rules
B.Azure AD Identity Protection user risk policies
C.Custom detection rules in Microsoft 365 Defender
D.Microsoft Defender for Cloud Apps policies
AnswerC

Custom detection rules in Microsoft 365 Defender allow security teams to write KQL queries that run across the rich, normalized data schema (such as DeviceEvents, DeviceProcessEvents, DeviceNetworkEvents, and EmailEvents) natively stored in the Defender platform. These rules can be configured to run on a schedule and generate alerts and incidents, integrating with automated investigation and response capabilities. Because they are native, they require no additional data connectors and they can leverage the full breadth of endpoint, email, and identity data already collected.

Why this answer

Microsoft 365 Defender provides a 'Custom detection' feature under the 'Advanced hunting' section that allows security teams to create custom detection rules based on Kusto Query Language (KQL) queries. This is the correct tool because the question specifies creating a detection for behavior not covered by built-in detections within the Microsoft 365 Defender ecosystem, and custom detection rules are designed exactly for that purpose—they run on a schedule and generate alerts when the custom query matches.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel analytics rules with Microsoft 365 Defender custom detection rules because both use KQL and create alerts, but Sentinel is a separate SIEM product, while the question explicitly asks for a tool within Microsoft 365 Defender.

How to eliminate wrong answers

Option A is wrong because Microsoft Sentinel analytics rules are used within the Azure Sentinel SIEM platform, not within Microsoft 365 Defender; while they can ingest data from Microsoft 365 Defender, they are not a tool native to the Defender portal for creating detections. Option B is wrong because Azure AD Identity Protection user risk policies focus on user risk levels (e.g., low, medium, high) and are not designed for custom behavioral detection—they use pre-defined risk signals and machine learning models, not custom KQL queries. Option D is wrong because Microsoft Defender for Cloud Apps policies are used for cloud app discovery, session controls, and app permissions, not for creating custom endpoint, email, or identity detections within Microsoft 365 Defender.

Full explanation →
39
Multi-Selectmedium

Your organization uses Microsoft Purview to classify sensitive data. You need to automatically apply a sensitivity label to documents that contain personally identifiable information (PII). Which TWO components should you configure?

Select 2 answers
A.Auto-labeling policy
B.Retention label
C.Data Loss Prevention (DLP) policy
D.Sensitivity label
E.Trainable classifier
AnswersA, D

An auto-labeling policy in Microsoft Purview applies sensitivity labels automatically based on conditions such as the presence of sensitive information types, including PII. This satisfies the stem’s requirement for automatic application without user intervention, using machine learning or exact data match classifiers to detect PII patterns within documents.

Why this answer

Auto-labeling policy (A) is correct because it automatically applies sensitivity labels to documents based on conditions such as the presence of sensitive data types (e.g., PII). Sensitivity label (D) is correct because it defines the classification and protection settings (e.g., encryption, markings) that are applied to the content. Together, they enable automatic classification of PII documents without manual user intervention.

Exam trap

The trap here is that candidates often confuse DLP policies (which detect and block data exfiltration) with auto-labeling policies (which apply classification labels), leading them to incorrectly select DLP policy as a component for automatic labeling.

Full explanation →
40
MCQeasy

A company wants to implement a secure web application gateway to protect their public-facing web apps from common exploits like SQL injection and cross-site scripting. Which Azure service should they use?

A.Azure Front Door with WAF
B.Azure Firewall
C.Azure DDoS Protection
D.Azure Application Gateway with WAF
AnswerD

Azure Application Gateway with WAF is a regional Layer 7 load balancer that handles HTTP(S) traffic with features like cookie-based session affinity, URL-path routing, and SSL termination. Its WAF SKU enforces managed rule sets from the OWASP Core Rule Set, including rules that detect and block SQL injection, cross-site scripting, command injection, and other common exploits. This makes it the ideal choice for a single web app that needs application-layer inspection and protection close to the backend.

Why this answer

Azure Application Gateway with WAF is the correct choice because it is a regional, layer-7 load balancer that includes a built-in Web Application Firewall (WAF) specifically designed to protect web applications from common exploits such as SQL injection and cross-site scripting (XSS). The WAF uses OWASP Core Rule Sets (CRS) to inspect HTTP/HTTPS traffic and block malicious payloads at the application layer, making it the ideal service for securing public-facing web apps.

Exam trap

The trap here is that candidates often confuse Azure Front Door with WAF as a direct alternative to Application Gateway with WAF, but Front Door is a global service for multi-region distribution, while Application Gateway is the regional, layer-7 load balancer with WAF that is the correct choice for protecting a single-region web application gateway.

How to eliminate wrong answers

Option A is wrong because Azure Front Door with WAF is a global, multi-region load balancer and CDN service that also includes WAF capabilities, but it is optimized for global distribution and edge caching, not for protecting a single regional web application gateway; the question implies a single gateway deployment, and Application Gateway is the standard regional choice. Option B is wrong because Azure Firewall is a stateful, network-layer firewall that filters traffic based on IP addresses, ports, and protocols (layers 3-4), and it does not inspect application-layer payloads like SQL injection or XSS; it lacks the WAF functionality required for web application exploits. Option C is wrong because Azure DDoS Protection provides mitigation against volumetric distributed denial-of-service attacks at layers 3 and 4, but it does not inspect or block application-layer attacks such as SQL injection or XSS, which require a WAF.

Full explanation →
41
MCQmedium

A company uses Microsoft Defender for Cloud to assess the security posture of their Azure subscriptions. They want to ensure that critical recommendations are automatically remediated. They create a workflow automation that triggers a Logic App for specific recommendations. However, the Logic App fails to run. What is the most likely cause?

A.The managed identity of the Logic App lacks permissions on the target resources.
B.The subscription is not onboarded to Defender for Cloud.
C.Defender for Cloud is disabled for the resource group.
D.The recommendation is disabled in the security policy.
AnswerA

The Logic App invoked by the workflow automation uses a managed identity for authentication. If that identity has not been granted the required Azure RBAC role (e.g., Contributor) on the target resources—such as the affected VMs or databases—the remediation steps will fail when the automation triggers. This is the most common cause where the logic app runs but cannot perform the intended action because it lacks the necessary permissions.

Why this answer

The most likely cause is that the Logic App's managed identity lacks the necessary permissions on the target Azure resources. Workflow automations in Defender for Cloud use a Logic App that executes remediation actions; if the Logic App's identity (either system-assigned or user-assigned) does not have the required RBAC role (e.g., Contributor or a custom role with specific actions) on the resource scope, the remediation run will fail with an authorization error. This is a common misconfiguration because the automation trigger itself succeeds, but the downstream action fails due to insufficient permissions.

Exam trap

The trap here is that candidates often assume the trigger itself is failing due to a misconfiguration in Defender for Cloud, when in fact the trigger succeeds and the failure is in the Logic App's downstream action due to missing RBAC permissions on the managed identity.

How to eliminate wrong answers

Option B is wrong because if the subscription were not onboarded to Defender for Cloud, the workflow automation trigger would not be available at all, and the Logic App would not even be invoked. Option C is wrong because Defender for Cloud operates at the subscription level, not the resource group level; disabling it for a resource group is not a valid configuration, and the automation trigger is subscription-wide. Option D is wrong because disabling a recommendation in the security policy would prevent the recommendation from appearing and thus prevent the trigger from firing, but the Logic App would not fail to run; it simply would not be triggered.

Full explanation →
42
MCQhard

You are designing a secure DevOps pipeline in GitHub that deploys to Azure Kubernetes Service (AKS). The security team requires that no secrets are stored in the pipeline variables and that all container images are scanned for vulnerabilities before deployment. Which approach aligns with security best practices?

A.Use Azure DevOps with a service principal that has a client secret stored in Azure Key Vault. Use Trivy to scan images.
B.Use GitHub Actions with OpenID Connect to authenticate to Azure without storing any secrets. Integrate Microsoft Defender for Containers to scan images in Azure Container Registry.
C.Use GitHub Actions with a managed identity for the GitHub runner. Disable image scanning to speed up deployments.
D.Use GitHub Actions with environment secrets for Azure service principal credentials. Use Docker Hub's vulnerability scanning.
AnswerB

OpenID Connect (OIDC) lets GitHub Actions authenticate to Azure AD using federated credentials, so the workflow receives a short-lived token without storing any client secret, password, or persistent key in the repository. Microsoft Defender for Containers integrates natively with Azure Container Registry to scan images for vulnerabilities on push, continuously assessing compliance and providing runtime protection without adding third-party components.

Why this answer

It uses OpenID Connect (OIDC) to authenticate GitHub Actions to Azure without storing any long-lived secrets, which aligns with the requirement that no secrets be stored in pipeline variables. Additionally, integrating Microsoft Defender for Containers provides vulnerability scanning for container images in Azure Container Registry (ACR), meeting the image scanning requirement before deployment to AKS.

Exam trap

The trap here is that candidates may assume Azure DevOps is the only secure option or that storing secrets in Azure Key Vault is acceptable, but the question explicitly requires 'no secrets stored in the pipeline variables,' and OIDC eliminates secrets entirely, while Key Vault still requires a secret retrieval step that counts as a stored secret in the pipeline context.

How to eliminate wrong answers

Option A is wrong because it uses Azure DevOps instead of GitHub Actions as specified in the question, and it stores a client secret in Azure Key Vault, which still requires a secret to be retrieved and used in the pipeline, violating the 'no secrets stored in pipeline variables' requirement. Option C is wrong because it disables image scanning, which directly contradicts the requirement that all container images be scanned for vulnerabilities before deployment. Option D is wrong because it uses environment secrets for Azure service principal credentials, which stores secrets in the pipeline environment, and Docker Hub's vulnerability scanning does not integrate with ACR or AKS for pre-deployment scanning in the Azure context.

Full explanation →
43
MCQhard

You are the lead security architect for a multinational corporation that recently completed a merger. The new entity, Contoso Ltd., has a complex Azure environment with over 200 subscriptions spread across multiple management groups. The company's security team has identified several critical issues: (1) many subscriptions have Azure Security Center's Secure Score below 30%, (2) there are numerous unmanaged VMs with public IP addresses, (3) there is no centralized logging for security events, and (4) identity management is fragmented with multiple Azure AD tenants. The CEO mandates a 'zero-trust' security posture within 12 months. You have a limited budget and must prioritize the most impactful actions. Which course of action should you take first?

A.Implement Azure Sentinel to centralize logs and create automated response playbooks
B.Deploy Azure Firewall and enforce forced tunneling for all VNets
C.Consolidate all Azure AD tenants into a single tenant and establish a common identity baseline
D.Deploy Azure Policy to deny creation of VMs with public IPs and enforce NSGs
AnswerC

Consolidating all Azure AD tenants into a single tenant and establishing a common identity baseline is the correct first step because zero-trust hinges on a single authoritative identity directory to enforce consistent conditional access, MFA, and least-privilege controls. With one tenant, you can apply a standard set of security policies (e.g., require hybrid Azure AD join, enforce device compliance, restrict legacy auth) uniformly across all subscriptions and resources, eliminating policy drift between fragmented directories. This creates the identity plane from which all access decisions are derived, which is the only way to satisfy the 'verify explicitly' pillar at scale.

Why this answer

Identity is the foundational control plane for zero-trust architecture. Without a unified identity baseline across a single Azure AD tenant, you cannot enforce consistent conditional access policies, least-privilege access, or authentication strength—making all other security controls ineffective. Consolidating tenants first directly addresses the fragmented identity management issue and enables centralized policy enforcement, which is the highest-impact, lowest-cost action to improve the security posture within 12 months.

Exam trap

The trap here is that candidates often prioritize network controls (Azure Firewall, forced tunneling) or monitoring tools (Azure Sentinel) because they seem more directly related to 'security' or 'visibility,' but the SC-100 exam emphasizes that identity is the new perimeter in zero-trust, and without a unified identity plane, all other controls are undermined.

How to eliminate wrong answers

Option A is wrong because implementing Azure Sentinel for centralized logging and automated response is a detection and response capability, not a preventive control; it does not address the root cause of unmanaged VMs, low Secure Score, or fragmented identity, and it requires significant budget and time to deploy effectively. Option B is wrong because deploying Azure Firewall and forced tunneling is a network-centric control that only mitigates lateral movement and data exfiltration risks; it does not solve the identity fragmentation or low Secure Score issues, and it incurs high operational overhead without addressing the foundational identity problem. Option D is wrong because deploying Azure Policy to deny public IPs and enforce NSGs is a compliance enforcement mechanism that only addresses one symptom (unmanaged VMs with public IPs) but does not fix the underlying identity fragmentation or enable centralized security event logging; without a unified identity, policy assignments cannot be consistently applied across multiple tenants.

Full explanation →
44
MCQeasy

You need to design a solution to synchronize on-premises Active Directory users to Microsoft Entra ID for hybrid identity. Which tool should you use?

A.Microsoft Identity Manager (MIM)
B.Microsoft Entra Connect
C.Microsoft Entra Connect Cloud Sync
D.Active Directory Federation Services (AD FS)
AnswerB

Microsoft Entra Connect is the primary, purpose-built tool for synchronizing on-premises Active Directory identities to Microsoft Entra ID. It replicates user, group, and device objects, and supports password hash synchronization, pass-through authentication, and federation integration. As the successor to DirSync and Azure AD Sync, it's the standard first-party solution for hybrid identity, and it is the correct choice when a straightforward, sanctioned sync mechanism is required.

Why this answer

Microsoft Entra Connect is the correct tool for synchronizing on-premises Active Directory users to Microsoft Entra ID for hybrid identity because it provides a comprehensive, full-featured synchronization engine that supports password hash synchronization, pass-through authentication, and federation integration. It is the primary tool for hybrid identity scenarios where you need to synchronize a single on-premises AD forest to a single Entra ID tenant, handling attributes, password writeback, and device synchronization.

Exam trap

The trap here is that candidates often confuse Microsoft Entra Connect Cloud Sync with the full Entra Connect tool, assuming the 'Cloud Sync' name implies it is the primary or newer replacement, but in reality, Entra Connect Cloud Sync is a lighter agent for specific multi-forest or limited scenarios, while Entra Connect remains the standard for full hybrid identity synchronization.

How to eliminate wrong answers

Option A is wrong because Microsoft Identity Manager (MIM) is an identity management and governance tool for managing on-premises identities and synchronization between multiple identity stores, not the primary tool for synchronizing a single on-premises AD to Entra ID for hybrid identity; it is more complex and typically used for advanced scenarios like cross-forest synchronization or identity lifecycle management. Option C is wrong because Microsoft Entra Connect Cloud Sync is a lightweight agent designed for synchronizing users from multiple on-premises AD forests to Entra ID, but it lacks full feature parity with Entra Connect (e.g., no device writeback, no pass-through authentication with seamless SSO, and limited attribute filtering) and is intended for specific scenarios like merging multiple forests or replacing older sync tools, not as the default for standard hybrid identity. Option D is wrong because Active Directory Federation Services (AD FS) is a federation service that provides single sign-on and claims-based authentication, not a synchronization tool; it does not synchronize user objects or attributes from on-premises AD to Entra ID.

Full explanation →
45
MCQmedium

A company plans to implement a Zero Trust architecture using Microsoft security solutions. They want to ensure that all access to corporate resources is verified explicitly, uses least privilege, and assumes breach. Which Microsoft service should be the central policy engine for enforcing conditional access decisions?

A.Microsoft Entra ID Conditional Access
B.Microsoft Defender for Cloud
C.Microsoft Sentinel
D.Microsoft Intune
AnswerA

Microsoft Entra ID Conditional Access is the core policy engine for Zero Trust, evaluating signals such as user identity, device health, location, and risk in real time. It enforces 'never trust, always verify' by granting, blocking, or requiring step-up authentication based on conditional policies. As the central access decision point, it integrates with all other Zero Trust pillars and is the primary mechanism for securing user access.

Why this answer

Microsoft Entra ID Conditional Access is the correct central policy engine because it directly enforces Zero Trust principles by evaluating signals (user, device, location, risk) in real time to grant or block access. It acts as the policy decision point (PDP) that enforces explicit verification, least privilege, and assumes breach by requiring continuous authentication and authorization for every access request.

Exam trap

The trap here is that candidates confuse Microsoft Defender for Cloud's security policy (which governs cloud resource configurations) with Entra ID's conditional access policy (which governs user access decisions), leading them to select Defender for Cloud as the central policy engine.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Cloud is a cloud security posture management (CSPM) and workload protection platform, not a policy engine for conditional access decisions. Option C is wrong because Microsoft Sentinel is a SIEM/SOAR solution for threat detection and response, not a real-time access policy enforcer. Option D is wrong because Microsoft Intune is a mobile device management (MDM) and mobile application management (MAM) service that manages devices and apps but does not make conditional access policy decisions.

Full explanation →
46
MCQmedium

Your company has a Microsoft 365 E5 subscription and uses Microsoft Defender for Office 365. You need to protect users from phishing attacks that use malicious links in email messages. The solution should allow users to report suspicious emails to the security team for analysis. You also want to automatically block repeated phishing attempts from the same sender. What should you configure?

A.Configure anti-spam policies and enable the Report Message add-in.
B.Configure Safe Links policies and enable the Report Message add-in for user reporting.
C.Configure Safe Attachments policies and enable the Report Message add-in.
D.Enable the Report Message add-in for Outlook and configure a mailbox for submissions.
AnswerB

Safe Links policies, part of Defender for Office 365, provide time-of-click protection by rewriting URLs to route through Microsoft's link-scanning service, blocking known malicious and newly detected phishing links. The Report Message add-in complements this by letting users flag unblocked suspicious links for analyst review, enabling detection and response improvements. Together they deliver both preventive blocking and user-driven feedback, which is the correct combined solution.

Why this answer

Safe Links protects users from clicking malicious links in real time, and the user reporting add-in allows reporting. Attack simulation training helps educate users but is not the primary protection mechanism. Option A is wrong because only the reporting add-in does not protect against links.

Option C is wrong because Safe Attachments protects attachments, not links. Option D is wrong because configuring a mailbox for submissions and enabling the Report Message add-in allows reporting but does not block malicious links; Safe Links is required for URL protection.

Full explanation →
47
MCQhard

Your organization uses Microsoft Sentinel for SIEM. You need to ensure that security incidents are automatically responded to without human intervention for known false positives. What should you implement?

A.An analytics rule with alert suppression
B.A playbook that runs on incident creation
C.An entity behavior analytics rule
D.An automation rule with incident closure action
AnswerD

Automation rules can auto-close incidents based on conditions.

Why this answer

Automation rules in Microsoft Sentinel can be configured to automatically close incidents when specific conditions are met, such as when an incident is identified as a known false positive. This eliminates the need for human intervention by triggering an incident closure action based on predefined criteria, directly addressing the requirement for automated response to false positives.

Exam trap

The trap here is that candidates often confuse alert suppression (which prevents duplicate alerts) with incident closure automation, or they assume a playbook is always required for automation, when in fact a simple automation rule with a closure action is the direct and correct solution for automatically handling known false positives.

How to eliminate wrong answers

Option A is wrong because analytics rules with alert suppression only prevent the creation of duplicate alerts for the same event within a specified time window; they do not automatically respond to or close incidents that have already been created. Option B is wrong because a playbook that runs on incident creation can automate responses, but it requires a separate automation rule to trigger it and is typically used for complex orchestration, not simply for closing known false positives without human intervention. Option C is wrong because entity behavior analytics rules are designed to detect anomalous behavior based on historical patterns, not to automatically respond to or close incidents identified as false positives.

Full explanation →
48
MCQmedium

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure resources. The security team wants to prioritize remediation of high-severity findings based on the greatest potential business impact. Which security policy or framework should you configure to align remediation with business priorities?

A.Use the Azure Security Benchmark initiative
B.Enable the Regulatory Compliance dashboard
C.Set up workflow automation for high-severity findings
D.Configure the Secure Score dashboard
AnswerB

The Regulatory Compliance dashboard in Microsoft Defender for Cloud maps security findings to specific regulatory standards (e.g., CIS, NIST SP 800-53, PCI DSS, ISO 27001) and tracks compliance status for each control. This directly ties security gaps to business and legal obligations, enabling you to prioritize remediation efforts based on which non-compliant controls carry the highest regulatory and business impact. By focusing on the standards that matter to your organization, you can align operational security work with audit deadlines, contractual obligations, and risk tolerance, making it the correct method for business-impact-centric prioritization.

Why this answer

The Regulatory Compliance dashboard in Microsoft Defender for Cloud allows you to map security controls to specific regulatory standards (e.g., SOC 2, ISO 27001, PCI DSS) and track compliance posture. By selecting a framework that aligns with your organization's business obligations (e.g., a standard required by customers or regulators), you can prioritize remediation of high-severity findings based on the greatest potential business impact, such as fines or loss of certification.

Exam trap

The trap here is that candidates often confuse the Secure Score dashboard (which measures overall security posture) with the Regulatory Compliance dashboard (which aligns remediation to specific business-impacting standards), leading them to select D instead of B.

How to eliminate wrong answers

Option A is wrong because the Azure Security Benchmark initiative is a Microsoft-defined set of best practices for Azure security, but it does not inherently map to business-specific regulatory or compliance priorities; it focuses on technical security posture rather than business impact. Option C is wrong because workflow automation (e.g., sending emails or creating tickets) is a response mechanism for findings, not a framework for prioritizing which findings to remediate based on business impact. Option D is wrong because the Secure Score dashboard provides a numerical score based on security recommendations, but it does not allow you to configure or align remediation with specific business or regulatory frameworks; it is a general health indicator, not a prioritization tool.

Full explanation →
49
Multi-Selectmedium

Your company uses Microsoft Defender for Cloud Apps to protect its SaaS environment. You need to configure settings to detect and block risky user activities. Which TWO actions should you take? (Choose TWO.)

Select 2 answers
A.Block all third-party app access.
B.Define IP address ranges for trusted locations.
C.Configure anomaly detection policies.
D.Configure app discovery policies.
E.Enable session monitoring for critical applications.
AnswersC, E

Anomaly detection policies in Defender for Cloud Apps apply machine learning and user entity behavior analytics (UEBA) to establish baseline activity for each user and then flag deviations such as mass downloads, impossible travel, failed sign-ins, or unusual admin operations. These policies are purpose-built to detect risky behaviors, including compromised users and insider threats, and can trigger automated remediation through integration with Microsoft 365. Because the scenario asks for protecting user activities by detecting suspicious actions, this is the most directly relevant configuration.

Why this answer

Options C and E are correct. Configuring anomaly detection policies (Option C) helps identify unusual user behaviors that may indicate a security threat. Enabling session monitoring for critical applications (Option E) allows real-time monitoring and control of user activities, which can block risky actions as they occur.

Option A is incorrect because blocking all third-party app access is overly restrictive and not a targeted measure for detecting risky user activities. Option B is incorrect because defining IP address ranges for trusted locations is for location-based policies, not for detecting risky behaviors. Option D is incorrect because app discovery policies are used to discover shadow IT, not to monitor or block risky user activities.

Full explanation →
50
MCQeasy

Your organization is adopting a Zero Trust security model. You need to design a solution that ensures continuous verification of user identity and device health before granting access to resources. Which Microsoft Entra ID feature should you prioritize?

A.Microsoft Entra ID Domain Services
B.Microsoft Entra ID Identity Protection
C.Microsoft Entra ID Conditional Access
D.Microsoft Entra ID Privileged Identity Management (PIM)
AnswerC

Microsoft Entra ID Conditional Access is the correct answer because it is the policy engine that evaluates real-time signals—such as user identity, group membership, location, device compliance, and sign-in risk—to allow or restrict access. It enables Zero Trust policies like requiring compliant devices, enforcing multi-factor authentication, and blocking sessions when risk is detected. Conditional Access also integrates with continuous access evaluation (CAE) to revoke access in near real-time when conditions change, directly aligning with the 'never trust, always verify' principle and your requirement for device health verification before access.

Why this answer

Conditional Access is the primary Microsoft Entra ID feature that enforces continuous verification by evaluating user identity, device health (via compliance policies or Microsoft Defender for Endpoint signals), location, and risk in real-time before granting access. It directly supports the Zero Trust principle of 'never trust, always verify' by requiring authentication and authorization at every access attempt, not just at the perimeter.

Exam trap

The trap here is that candidates confuse Identity Protection's risk detection capabilities with the enforcement mechanism, but Identity Protection alone cannot block access based on device health or enforce conditional policies—it only provides signals that must be consumed by Conditional Access to make a decision.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Domain Services provides managed domain services like LDAP, Kerberos, and NTLM for legacy applications, not continuous identity or device health verification. Option B is wrong because Identity Protection focuses on detecting and responding to identity-based risks (e.g., leaked credentials, anomalous sign-ins) but does not enforce access decisions based on device health or real-time verification; it feeds risk signals into Conditional Access. Option D is wrong because Privileged Identity Management (PIM) manages just-in-time privileged role activation and approval workflows, not continuous verification of all user identities or device health for general resource access.

Full explanation →
51
Multi-Selectmedium

Your company is deploying Microsoft Sentinel in a government agency that requires strict data residency. You need to ensure that all Sentinel data is stored within the United States. Which THREE actions must you take to meet this requirement?

Select 3 answers
A.Disable cross-region replication in the Log Analytics workspace settings.
B.Create the Log Analytics workspace in an Azure region in the United States (e.g., East US).
C.Configure data export to a storage account in a different region for redundancy.
D.Enable customer-managed keys (CMK) using Azure Key Vault in the same region.
E.Use Azure Policy to audit workspace region for compliance.
AnswersA, B, E

Correct. Disabling cross-region replication ensures data stays in the primary region, preventing replication to another region.

Why this answer

To ensure data residency within the United States, you must create the Log Analytics workspace in a US Azure region (Option B) and disable cross-region replication (Option A). Additionally, you should use Azure Policy to audit workspace region for compliance (Option E) to continuously monitor and enforce data residency requirements. Customer-managed keys (Option D) provide encryption control but are not strictly required for data residency.

Data export to a different region (Option C) would violate residency.

Full explanation →
52
MCQmedium

Your organization wants to implement a zero-trust security model for on-premises and cloud resources. As part of this strategy, you need to ensure that all access requests are authenticated and authorized based on dynamic risk signals. Which Microsoft security solution should you use to enforce conditional access policies based on real-time risk?

A.Microsoft Entra ID Conditional Access
B.Microsoft Intune
C.Microsoft Sentinel
D.Microsoft Defender for Cloud
AnswerA

Microsoft Entra ID Conditional Access is the policy enforcement engine that operationalizes zero trust by evaluating real-time signals such as user identity, device health, location, and risk level at the moment of authentication. It dynamically allows or blocks access, or requires additional controls like MFA or session policies, integrated directly with identity authentication. This makes it the central decision point for enforcing conditional access policies, rather than a supporting or monitoring tool.

Why this answer

Microsoft Entra ID Conditional Access is the correct solution because it enables you to enforce access policies based on real-time risk signals, such as user risk, sign-in risk, and device compliance. It integrates with Identity Protection to evaluate dynamic risk levels and can block or require multi-factor authentication (MFA) accordingly, directly supporting the zero-trust principle of 'never trust, always verify'.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel (a SIEM) with a real-time access control solution, but Sentinel only provides detection and response after the fact, not inline policy enforcement during authentication.

How to eliminate wrong answers

Option B (Microsoft Intune) is wrong because it is a mobile device management (MDM) and mobile application management (MAM) solution that focuses on device compliance and app protection policies, not on real-time risk-based conditional access enforcement. Option C (Microsoft Sentinel) is wrong because it is a security information and event management (SIEM) and security orchestration automated response (SOAR) solution that aggregates logs and detects threats, but it does not natively enforce conditional access policies at the authentication layer. Option D (Microsoft Defender for Cloud) is wrong because it is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that provides recommendations and threat protection for cloud workloads, not real-time risk-based access control for user sign-ins.

Full explanation →
53
MCQhard

Your organization plans to use Microsoft Purview to protect sensitive data in Microsoft 365. The compliance team needs to detect when users share credit card numbers via email and automatically apply encryption. Which solution should you implement?

A.Microsoft Purview Audit
B.Microsoft Purview eDiscovery
C.Microsoft Purview Information Protection
D.Microsoft Purview Data Loss Prevention (DLP)
AnswerD

Microsoft Purview Data Loss Prevention (DLP) policies continuously monitor emails for sensitive information types such as credit card numbers or social security numbers, and when a match is detected, the policy can automatically trigger protection actions. In Exchange Online, DLP leverages transport rules to apply IRM encryption to outbound messages, ensuring only intended recipients can read them. This capability directly aligns with the requirement to automatically encrypt emails based on content, making DLP the correct choice.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect sensitive data types—such as credit card numbers—in email messages and automatically apply protective actions like encryption. DLP policies can inspect email content in transit via Exchange Online, match patterns against predefined sensitive info types (e.g., credit card number regex), and trigger actions such as 'Encrypt the message' using Azure Rights Management. This directly meets the requirement to detect sharing of credit card numbers and enforce encryption automatically.

Exam trap

Microsoft often tests the distinction between Information Protection (labeling/classification) and Data Loss Prevention (content inspection and automated enforcement), leading candidates to pick Information Protection because they confuse 'protecting data' with 'detecting and acting on sensitive content.'

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Audit only logs user and admin activities for forensic review; it cannot inspect email content for sensitive data or apply encryption. Option B is wrong because Microsoft Purview eDiscovery is used for searching and exporting content in legal or compliance investigations, not for real-time detection and automated protection of sensitive data in transit. Option C is wrong because Microsoft Purview Information Protection focuses on classifying and labeling documents and emails (e.g., sensitivity labels), but it does not natively scan for specific sensitive data patterns like credit card numbers or enforce automatic encryption based on content detection—that requires DLP policies to trigger the label or encryption action.

Full explanation →
54
MCQhard

Your organization uses Microsoft Sentinel. You need to design a solution to detect and automatically respond to a potential brute-force attack against an on-premises application that is published via Azure AD Application Proxy. The solution should block the attacker's IP address in Azure AD Conditional Access for one hour after detecting more than 10 failed login attempts within 5 minutes. What should you implement?

A.Create a Microsoft Purview Data Loss Prevention policy to block the IP address based on the login pattern.
B.Create a Microsoft Sentinel analytics rule that triggers on a KQL query detecting the failed logins, then use a playbook to add the IP to a Conditional Access block list via the Azure AD API.
C.Deploy a web application firewall (WAF) in front of the application and configure rate limiting to block the IP.
D.Configure a Microsoft Entra ID Protection sign-in risk policy to automatically block the user's sign-in after detecting anomalous activity.
AnswerB

Microsoft Sentinel can ingest sign-in logs from Azure AD Application Proxy. An analytics rule with a KQL query can detect the brute-force pattern, and when triggered, a playbook can call the Azure AD API to add the IP to a Conditional Access block list for one hour, effectively blocking the attacker.

Why this answer

You can create a Microsoft Sentinel analytics rule with a KQL query that detects more than 10 failed login attempts within 5 minutes. When the rule triggers, it runs a playbook that uses the Azure AD API to add the attacker's IP to a Conditional Access block list, blocking further access for one hour. Option A is incorrect because Microsoft Purview DLP policies are for data protection, not authentication blocking.

Option C is incorrect because a WAF rate limit blocks at the network layer but does not integrate with Azure AD Conditional Access, and it cannot read authentication logs from Azure AD App Proxy. Option D is incorrect because Microsoft Entra ID Protection sign-in risk policies are user-based and cannot block specific IPs or apply custom logic like a 1-hour block.

Full explanation →
55
Multi-Selecthard

A company wants to automate incident response in Microsoft 365 Defender. Which THREE actions can be automated using automated investigation and response (AIR) capabilities? (Choose three.)

Select 3 answers
A.Block a file hash across the organization.
B.Reset a user's password.
C.Isolate a device from the network.
D.Create a new user account.
E.Delete a malicious email from all mailboxes.
AnswersA, C, E

AIR can block indicators of compromise.

Why this answer

Microsoft 365 Defender's automated investigation and response (AIR) can automatically block a file hash at the tenant level using threat intelligence and cloud-delivered protection. When a malicious file is detected, AIR can create an indicator to block the hash across all endpoints via Microsoft Defender for Endpoint, preventing further execution.

Exam trap

Candidates often mistake identity-related actions like password resets as part of AIR, but these are handled by separate Azure AD Identity Protection workflows. AIR actions are limited to endpoint, email, and collaboration containment.

Full explanation →
56
MCQhard

An organization is implementing a Zero Trust identity strategy. They have a mix of on-premises Active Directory and Azure AD. They want to enforce conditional access policies that require device compliance for accessing sensitive apps. However, some users report that their devices are not being evaluated for compliance even though they are enrolled in Microsoft Intune. What should the organization check first?

A.Ensure Intune compliance policies are assigned to the correct user groups
B.Confirm that devices are Azure AD Joined
C.Check if users have enabled multi-factor authentication
D.Verify that devices are registered in Azure AD
AnswerD

Device registration in Azure AD creates the unique device identity that ties the user, device, and compliance state together. Conditional Access’s 'Require device to be marked as compliant' grant depends on the device being registered (via Azure AD Join or Azure AD Registered) and having its compliance status reported by Intune. Without this registration, the compliance claim is absent, and the access request is blocked.

Why this answer

Device compliance evaluation in a hybrid identity environment requires that devices are registered in Azure AD (Azure AD Registration) so that Azure AD can associate the device identity with Intune compliance data. Even if a device is enrolled in Intune, without Azure AD registration, Conditional Access policies cannot evaluate its compliance status because the device identity is not recognized by Azure AD during authentication.

Exam trap

The trap here is that candidates assume Intune enrollment alone is sufficient for device compliance evaluation, but Azure AD registration is the prerequisite that links the device identity to Azure AD for Conditional Access to enforce compliance policies.

How to eliminate wrong answers

Option A is wrong because Intune compliance policies must be assigned to the correct user groups, but this does not affect whether a device is evaluated for compliance; it only determines which users' devices receive the policy. Option B is wrong because devices do not need to be Azure AD Joined; they can be Azure AD Registered (workplace-joined) or Hybrid Azure AD Joined, and Azure AD Joined is not a prerequisite for compliance evaluation. Option C is wrong because multi-factor authentication is an authentication requirement, not a device compliance requirement; enabling MFA does not cause a device to be evaluated for compliance.

Full explanation →
57
MCQeasy

Your organization is implementing a Zero Trust security model. Which Microsoft security solution should you use to enforce conditional access policies based on user, device, location, and real-time risk signals?

A.Microsoft Entra ID Conditional Access
B.Microsoft Defender for Cloud Apps
C.Microsoft Intune
D.Microsoft Purview
AnswerA

Microsoft Entra ID Conditional Access is the direct policy engine for access control in a Zero Trust architecture. It continuously evaluates signals such as user identity, group membership, location, device compliance, and real-time risk (from Entra ID Protection) to enforce granular decisions like allow, deny, or require MFA. Because it applies these conditions to every sign-in and session in real time, it is the core mechanism for implementing 'explicit verification' in Zero Trust.

Why this answer

Microsoft Entra ID Conditional Access is the correct solution because it is the native policy engine in Azure AD that evaluates signals from user identity, device compliance, location (IP ranges or countries), and real-time risk from Microsoft Entra ID Protection to enforce access decisions. It directly implements the 'explicit verification' and 'assume breach' principles of Zero Trust by blocking or requiring step-up authentication based on these dynamic conditions.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud Apps as the primary policy enforcement point because of its session monitoring capabilities, but it is actually a downstream consumer of Conditional Access decisions, not the engine that evaluates user, device, location, and risk signals in real time.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides shadow IT discovery, session controls, and data protection, but it does not natively enforce conditional access policies based on user, device, location, and risk signals—it integrates with Conditional Access for those decisions. Option C is wrong because Microsoft Intune is a Mobile Device Management (MDM) and Mobile Application Management (MAM) solution that manages device compliance and app protection policies, but it does not evaluate real-time risk signals or enforce access policies at the authentication layer. Option D is wrong because Microsoft Purview is a data governance, compliance, and information protection solution focused on data classification, labeling, and eDiscovery, not on enforcing authentication-time conditional access based on user, device, location, or risk.

Full explanation →
58
MCQmedium

A company is deploying Microsoft Defender for Cloud to protect a multi-cloud environment that includes Azure and AWS. The security team wants to prioritize the highest-risk recommendations. Which feature should they use to identify and focus on the most critical security issues?

A.Use Secure Score and its recommendations
B.Regulatory Compliance dashboard
C.Enable Defender for Cloud's enhanced security features
D.Review attack path analysis
AnswerA

Secure Score quantifies organizational security posture as a percentage by scoring controls across workloads. Each recommendation is mapped to a control and shows the potential score increase if remediated, directly enabling risk-based prioritization. Defender for Cloud's recommendations page defaults to sorting by Secure Score impact, so this is the primary mechanism for deciding what to remediate first.

Why this answer

Secure Score in Microsoft Defender for Cloud aggregates all security recommendations and assigns a score based on their relative risk and impact. By focusing on recommendations that most improve the Secure Score, the security team can systematically prioritize the highest-risk issues across both Azure and AWS resources. This directly aligns with the goal of identifying and focusing on the most critical security issues.

Exam trap

The trap here is that candidates often confuse 'enhanced security features' (which enable advanced detections) with 'prioritization features' (which rank recommendations by risk), leading them to select Option C instead of recognizing that Secure Score is the dedicated prioritization mechanism.

How to eliminate wrong answers

Option B is wrong because the Regulatory Compliance dashboard is designed to track adherence to specific compliance standards (e.g., SOC 2, ISO 27001) and does not inherently prioritize recommendations by risk; it focuses on compliance gaps rather than overall security risk. Option C is wrong because enabling enhanced security features (e.g., Defender for Servers, Defender for SQL) expands the scope of monitoring and threat detection but does not itself provide a prioritization mechanism; it is a prerequisite for advanced protections, not a prioritization tool. Option D is wrong because attack path analysis is a visual tool that maps potential attack vectors but is used for deep investigation of specific threats, not for broad prioritization of all recommendations; it is reactive and scenario-specific, not a holistic risk-ranking feature.

Full explanation →
59
MCQhard

A company deploys Azure Bastion in a VNet. They want to allow a security engineer to connect to a Windows VM in a peered VNet using Azure Bastion. The engineer can see the VM in the portal but cannot connect. Which configuration is most likely missing?

A.The Azure Bastion subnet size is /28.
B.The peered VNet does not have 'Allow Azure Bastion Communication' enabled on the peering connection.
C.The VM's subnet does not have an inbound NSG rule allowing RDP (3389) from the Azure Bastion subnet.
D.The VM does not have Azure AD authentication enabled.
AnswerB

The 'Allow Azure Bastion Communication' setting on a VNet peering connection is specifically required for Bastion to communicate with resources in a peered VNet. This setting must be enabled on both sides of the peering relationship: the VNet that contains the Bastion host and the VNet that contains the target VM. If this setting is disabled on either side, the Bastion service cannot establish a session to the VM's private IP, even if other network paths are open. The peering setting is the explicit gate for cross-VNet Bastion access, making it the correct root cause.

Why this answer

Azure Bastion requires the 'Allow Azure Bastion Communication' setting to be enabled on the peering connection for the peered VNet. Without this, the Bastion service cannot route traffic to the target VM in the peered VNet, even though the VM is visible in the portal. This setting allows the Bastion's control plane and data plane to communicate across the peering link.

Exam trap

The trap here is that candidates assume NSG rules on the VM subnet are the primary blocker, but Azure Bastion's peering requirement is a distinct, often-missed setting that controls cross-VNet connectivity.

How to eliminate wrong answers

Option A is wrong because a /28 subnet size is the minimum required for Azure Bastion and is not a connectivity issue; the engineer can see the VM, indicating the Bastion is deployed correctly. Option C is wrong because Azure Bastion uses its own private IPs (from the AzureBastionSubnet) to connect to VMs, and NSG rules on the VM's subnet are not required—Bastion bypasses them via the service's built-in network hardening. Option D is wrong because Azure AD authentication is optional for RDP connections via Bastion; the default username/password or certificate-based authentication works without Azure AD.

Full explanation →
60
MCQhard

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. The policy is enabled but users who are detected as high risk are still able to sign in. What is the most likely reason?

A.No users or groups are assigned to the policy
B.The policy state is set to 'enabled' but not 'enforced'
C.The user risk level is set to 'high' but sign-in risk is 'medium'
D.The grant control is set to 'block' but should be 'require MFA'
AnswerA

The exhibit does not show user assignment; if none, the policy won't apply.

Why this answer

A Conditional Access policy must have at least one user or group assigned to it to be evaluated. If no users or groups are assigned, the policy is effectively inactive, even if enabled. In this scenario, the policy is enabled but not applied to any identities, so high-risk users are not subject to its controls.

Exam trap

The SC-100 exam often tests the misconception that an enabled policy is automatically applied to all users, but the trap here is that the policy must have explicit assignments to take effect.

How to eliminate wrong answers

Option B is wrong because Conditional Access policies do not have an 'enforced' state; they are either 'enabled' or 'disabled'. An enabled policy is active and enforced. Option C is wrong because the user risk level and sign-in risk are separate conditions; setting user risk to 'high' does not require sign-in risk to be set, and the policy would still block high-risk users if assigned.

Option D is wrong because the grant control 'block' is the correct setting to prevent sign-ins; changing it to 'require MFA' would allow sign-ins with MFA, not block them.

Full explanation →
61
MCQmedium

Your company uses Microsoft Defender XDR to protect endpoints. The security team wants to implement automated response actions when a malicious file is detected on a device. Which Microsoft security feature should you configure to automatically isolate the affected device from the network?

A.Automated investigation and response (AIR) capabilities
B.Microsoft Sentinel automation rules
C.Attack surface reduction rules
D.Microsoft Intune compliance policies
AnswerA

Automated investigation and response (AIR) is a built-in Microsoft Defender XDR engine that orchestrates detection, investigation, and remediation across endpoints. When malicious activity such as a suspected ransomware or credential theft is identified, AIR can automatically perform device isolation — a native action that severs the endpoint's network connections while preserving communication with Defender for Endpoint services. This isolation can be executed without human intervention or with approval depending on the automation level configured, making it the appropriate capability for this requirement.

Why this answer

Automated investigation and response (AIR) in Microsoft Defender XDR is the correct feature because it includes built-in playbooks that can automatically isolate a device from the network when a malicious file is detected. AIR leverages the Microsoft 365 Defender portal's automation capabilities to run investigation steps and execute response actions, such as device isolation, without manual intervention. This directly meets the requirement for automated response upon file detection.

Exam trap

The trap here is that candidates often confuse the proactive prevention capabilities of Attack surface reduction rules with the automated response capabilities of AIR, or they overestimate the real-time response abilities of Intune compliance policies, which are designed for configuration enforcement rather than incident response actions like network isolation.

How to eliminate wrong answers

Option B is wrong because Microsoft Sentinel automation rules are designed for cloud-scale SIEM and SOAR across multiple data sources, not for endpoint-specific automated isolation triggered by Defender XDR detections; they require custom analytics and playbooks to achieve similar behavior, making them less direct for this use case. Option C is wrong because Attack surface reduction rules are proactive policies that block or audit specific behaviors (e.g., Office apps creating child processes) to prevent infection, but they do not perform automated response actions like device isolation after a file is already detected as malicious. Option D is wrong because Microsoft Intune compliance policies enforce device configuration and health requirements (e.g., requiring encryption or a minimum OS version) and can trigger conditional access blocks, but they cannot automatically isolate a device from the network in real time based on a malicious file detection; that action is outside Intune's scope.

Full explanation →
62
MCQhard

A company needs to design a secure DevOps pipeline using GitHub Actions and Microsoft Defender for Cloud. They want to scan infrastructure-as-code (IaC) templates for misconfigurations before deployment. What should they integrate?

A.Microsoft Defender for Cloud Infrastructure as Code scanning
B.Microsoft Purview Compliance Manager
C.Microsoft Sentinel
D.Microsoft Defender for Cloud Apps
AnswerA

Microsoft Defender for Cloud Infrastructure as Code scanning is the correct choice because it directly integrates with DevOps platforms like GitHub and Azure DevOps to continuously scan Infrastructure as Code templates (e.g., ARM, Bicep, Terraform) in pull requests and pipelines. It leverages Defender for Cloud's security recommendations and policy library to identify misconfigurations before deployment, preventing insecure cloud resources from ever being provisioned. This is a native cloud security posture management capability purpose-built for IaC validation.

Why this answer

Microsoft Defender for Cloud includes a native Infrastructure as Code (IaC) scanning capability that integrates directly with GitHub Actions. This feature automatically analyzes IaC templates (such as ARM, Bicep, Terraform, and CloudFormation) for security misconfigurations during the CI/CD pipeline, providing pre-deployment guardrails. By failing the pipeline on critical findings, it ensures only compliant infrastructure is deployed, aligning with the secure DevOps principle of shifting security left.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud's IaC scanning with Microsoft Sentinel's threat detection capabilities, mistakenly thinking Sentinel can scan code before deployment, when in fact Sentinel only analyzes logs and alerts from already-deployed resources.

How to eliminate wrong answers

Option B (Microsoft Purview Compliance Manager) is wrong because it focuses on regulatory compliance posture management and risk assessments, not on scanning IaC templates for misconfigurations in a DevOps pipeline. Option C (Microsoft Sentinel) is wrong because it is a SIEM and SOAR solution for threat detection and incident response after deployment, not a pre-deployment IaC scanning tool. Option D (Microsoft Defender for Cloud Apps) is wrong because it is a CASB (Cloud Access Security Broker) for controlling user access and data protection in SaaS applications, not for scanning infrastructure code.

Full explanation →
63
Multi-Selectmedium

Your organization uses Microsoft Entra ID and Microsoft Intune. You need to design a solution that allows only hybrid Azure AD joined devices to access a sensitive application. The solution must also require that the device is compliant with company policies. Which two components should you configure? (Choose TWO.)

Select 2 answers
A.Intune app protection policy
B.Conditional Access policy with 'Require multifactor authentication'
C.Conditional Access policy with 'Require hybrid Azure AD joined device'
D.Intune device enrollment
E.Intune device compliance policy
AnswersC, E

This ensures only hybrid Azure AD joined devices can access the application.

Why this answer

Options C and E are correct. A Conditional Access policy with the 'Require hybrid Azure AD joined device' grant control ensures that only devices joined to both on-premises AD and Azure AD can access the application. An Intune device compliance policy defines the security and configuration requirements that devices must meet to be considered compliant.

Combining these two components enforces both device identity and compliance. Option A (Intune app protection policy) is incorrect because it protects app data at the app level, not device-level access. Option B (Require MFA) is not required by the scenario.

Option D (Intune device enrollment) is a prerequisite for management but not an access control.

Full explanation →
64
MCQmedium

Wide World Importers uses Azure Active Directory (now Microsoft Entra ID) and Microsoft 365. They have a hybrid identity with password hash sync. They want to implement a passwordless authentication strategy to improve security and user experience. They have a mix of Windows 10/11 devices and mobile devices (iOS/Android). They also have some shared computers in kiosk mode. The solution must support all user scenarios and align with Microsoft's authentication best practices. What should you recommend?

A.Use SMS-based authentication for all users. Deploy OATH tokens for shared computers. Implement Azure AD Conditional Access to require passwordless for admins only.
B.Implement Windows Hello for Business for all Windows devices. Use smart cards for mobile devices. Use FIDO2 keys for shared computers.
C.Implement Windows Hello for Business for Windows 10/11 devices. Deploy Microsoft Authenticator for mobile devices for passwordless sign-in. Use FIDO2 security keys for shared computers and kiosk scenarios. Enable combined registration for self-service password reset and Microsoft Authenticator.
D.Use the Microsoft Authenticator app for all users. Configure passwordless sign-in with the app. Use QR codes for kiosk computers.
AnswerC

Comprehensive passwordless approach covering all device types.

Why this answer

It aligns with Microsoft's passwordless authentication best practices by using Windows Hello for Business for Windows 10/11 devices (which supports biometric and PIN-based sign-in), Microsoft Authenticator for mobile devices (enabling phone-sign-in passwordless authentication), and FIDO2 security keys for shared computers and kiosk scenarios (which provide hardware-backed, phishing-resistant credentials). Combined registration streamlines the user enrollment process for both SSPR and Microsoft Authenticator, ensuring a seamless deployment across all device types.

Exam trap

The trap here is that candidates may assume SMS-based authentication or smart cards are acceptable passwordless methods, but Microsoft's best practices explicitly exclude SMS due to security weaknesses and smart cards due to lack of mobile device support, while FIDO2 keys are the only recommended solution for shared/kiosk computers.

How to eliminate wrong answers

Option A is wrong because SMS-based authentication is not truly passwordless (it relies on a phone number and one-time code, which is susceptible to SIM-swap attacks and does not meet Microsoft's passwordless best practices), and OATH tokens for shared computers are not a recommended passwordless solution for kiosk scenarios (FIDO2 keys are preferred for phishing resistance). Option B is wrong because smart cards are not a practical or supported passwordless solution for mobile devices (iOS/Android do not natively support smart card authentication without additional hardware and middleware), and Windows Hello for Business is not available on all Windows devices (it requires Windows 10/11 Pro or Enterprise with TPM 2.0, and shared computers in kiosk mode may not support it). Option D is wrong because using Microsoft Authenticator for all users ignores Windows Hello for Business for Windows devices (which provides a better integrated experience), and QR codes for kiosk computers are not a supported passwordless authentication method for shared devices (FIDO2 keys are required for kiosk scenarios).

Full explanation →
65
MCQhard

Contoso Ltd. is a multinational organization with a hybrid environment consisting of on-premises Active Directory and Azure AD (now Microsoft Entra ID). They use Microsoft Defender for Cloud Apps, Microsoft Sentinel, and Microsoft 365 Defender. The security operations team has noticed that several high-severity alerts from Microsoft 365 Defender are not being forwarded to Microsoft Sentinel, causing delayed response. The team has confirmed that the data connector between Microsoft 365 Defender and Sentinel is enabled and appears healthy. However, only low-severity alerts appear in Sentinel. Further investigation reveals that the Microsoft 365 Defender portal has a configured rule set that suppresses high-severity alerts for certain users deemed low risk. The security operations manager wants to ensure all high-severity alerts are sent to Sentinel without changing the suppression rules in Microsoft 365 Defender, as those rules are required for operational efficiency. What should the team do to ensure high-severity alerts are ingested into Sentinel?

A.Modify the suppression rules in Microsoft 365 Defender to not suppress high-severity alerts.
B.In the Microsoft 365 Defender data connector in Sentinel, enable the option to include suppressed alerts.
C.Use the Microsoft Graph Security API connector in Sentinel to ingest alerts instead.
D.Create a separate Logic App to fetch high-severity alerts from Microsoft 365 Defender API and send them to Sentinel.
AnswerB

The Microsoft 365 Defender data connector in Microsoft Sentinel includes a configuration option called 'include suppressed alerts' that, when enabled, ingests all alerts regardless of their suppression status in Defender. This setting is the intended, supported mechanism to ensure high-severity alerts that are suppressed in the Defender console still appear in Sentinel for correlation, hunting, and incident response. Enabling this option preserves the existing suppression rules for day-to-day analyst workflows while giving Sentinel full visibility, exactly satisfying the manager's requirement to keep suppression rules unchanged and preventing missed alerts.

Why this answer

The Microsoft 365 Defender data connector in Microsoft Sentinel includes a configuration setting to 'Include suppressed alerts.' Enabling this option forces Sentinel to ingest all alerts from Microsoft 365 Defender, including those that are suppressed by rule sets in the Defender portal. This satisfies the requirement to forward high-severity alerts without modifying the suppression rules that the operations team relies on for operational efficiency.

Exam trap

The trap here is that candidates assume suppressed alerts are permanently hidden and cannot be ingested, leading them to choose either modifying the suppression rules (Option A) or building a custom workaround (Option D), when in fact the Sentinel connector has a specific toggle to include suppressed alerts.

How to eliminate wrong answers

Option A is wrong because it directly contradicts the requirement to keep the suppression rules unchanged; modifying the rules would break operational efficiency. Option C is wrong because the Microsoft Graph Security API connector ingests alerts from various Microsoft security products but does not bypass the suppression logic applied within Microsoft 365 Defender; suppressed alerts would still be omitted unless the API is specifically configured to include them, which is not a standard option. Option D is wrong because creating a separate Logic App to fetch high-severity alerts via the Microsoft 365 Defender API would be a complex, custom workaround that duplicates functionality already built into the Sentinel connector, and it would still need to handle the suppression flag to retrieve suppressed alerts, making it less efficient and more error-prone than the native connector option.

Full explanation →
66
Multi-Selectmedium

A company is implementing a Zero Trust identity strategy. They want to ensure that only compliant and managed devices can access corporate resources. Which THREE components should they include in their solution? (Choose three.)

Select 3 answers
A.Microsoft Intune for device management and compliance policies
B.Azure AD device registration
C.Azure AD Conditional Access policies
D.Azure AD Application Proxy
E.Azure AD B2B collaboration
AnswersA, B, C

Intune manages device compliance and enforces policies.

Why this answer

A is correct because Microsoft Intune provides device management and compliance policies that define the security posture required for managed devices, such as requiring encryption, a minimum OS version, or a specific patch level. These compliance policies are evaluated by Azure AD during authentication, ensuring only devices that meet the organization's security standards can access corporate resources.

Exam trap

The trap here is that candidates may confuse Azure AD Application Proxy (a publishing tool) with a device compliance mechanism, or assume Azure AD B2B collaboration can enforce device management for external users, when in fact neither component evaluates device health or management status.

Full explanation →
67
MCQhard

A government agency, Northwind, is deploying a sensitive application on Azure App Service Environment (ASE) v3. The application handles classified data and must meet FedRAMP High requirements. You need to design a security solution that includes: (1) encryption at rest for the app's content and configuration, (2) encryption in transit with TLS 1.2 or higher, (3) network isolation using VNet integration and private endpoints, (4) identity-based access to Azure SQL Database using managed identity, and (5) certificate management for custom domains using Azure Key Vault. Which of the following designs meets all requirements?

A.Deploy the app on a multi-tenant App Service plan, enforce HTTPS only with TLS 1.2, use a system-assigned managed identity to access Azure SQL Database, and configure TLS/SSL certificates from Azure Key Vault.
B.Deploy the app on an ASE v3 in a VNet, enforce HTTPS only with TLS 1.2, use a system-assigned managed identity to access Azure SQL Database, and configure TLS/SSL certificates from Azure Key Vault.
C.Deploy the app on an ASE v3 in a VNet, enforce HTTPS only with TLS 1.2, use a user-assigned managed identity to access Azure SQL Database, and configure TLS/SSL certificates from App Service certificates.
D.Deploy the app on an ASE v3 in a VNet, enforce HTTPS only with TLS 1.2, use a service principal to access Azure SQL Database, and configure TLS/SSL certificates from Azure Key Vault.
AnswerB

ASE v3 provides network isolation, managed identity provides secure database access, and Key Vault handles certificates.

Why this answer

ASE v3 is deployed in a VNet, providing network isolation. Enforcing HTTPS only with TLS 1.2 ensures encryption in transit. Using system-assigned managed identity allows identity-based access to Azure SQL Database.

TLS/SSL certificates from Azure Key Vault support certificate management. Option A is wrong because a multi-tenant App Service plan does not provide network isolation, failing the VNet integration requirement. Option C is wrong because App Service certificates are not managed via Key Vault, failing the certificate management requirement.

Option D is wrong because service principal is less secure than managed identity and does not meet the identity-based access requirement.

Full explanation →
68
MCQeasy

A company uses Azure Policy to enforce that all storage accounts must have HTTPS traffic only. They assign a built-in policy to audit this setting. A developer creates a new storage account with HTTP enabled, and the policy reports it as non-compliant. What should the company do to automatically remediate this violation?

A.Enable Azure Security Center's just-in-time access for storage accounts.
B.Change the policy effect to 'Deny' to prevent creation of non-compliant storage accounts.
C.Ask the developer to manually enable HTTPS-only on the storage account.
D.Create a new policy assignment with a 'deployIfNotExists' effect that enables HTTPS-only.
AnswerD

A policy assignment with the deployIfNotExists effect triggers remediation when Azure Policy evaluates an existing storage account that lacks HTTPS-only. It deploys a nested Microsoft.Storage/storageAccounts resource to set the supportsHttpsTrafficOnly property to true, bringing the account into compliance automatically. This approach, often paired with a remediation task, provides continuous and scalable enforcement for both existing and newly created accounts.

Why this answer

The 'deployIfNotExists' effect in Azure Policy can automatically remediate non-compliant resources by deploying a configuration (such as enabling HTTPS-only) when the policy detects a violation. This effect runs a remediation task that modifies the resource to meet the policy requirement, eliminating the need for manual intervention. In this scenario, it would automatically enable HTTPS traffic on the storage account, bringing it into compliance.

Exam trap

The trap here is that candidates often confuse the 'Deny' effect (which only blocks new non-compliant resources) with 'deployIfNotExists' (which remediates existing non-compliant resources), leading them to choose Option B instead of D.

How to eliminate wrong answers

Option A is wrong because Azure Security Center's just-in-time (JIT) access is a feature for managing virtual machine access, not for enforcing storage account HTTPS settings. Option B is wrong because changing the policy effect to 'Deny' would prevent creation of new non-compliant storage accounts but would not remediate the already existing non-compliant account; it only blocks future violations. Option C is wrong because asking the developer to manually enable HTTPS-only is a manual workaround that does not leverage Azure Policy's automated remediation capabilities, and it does not scale or enforce consistency across the environment.

Full explanation →
69
Multi-Selecthard

You are designing a network security strategy for a multicloud environment that includes Azure and Amazon Web Services (AWS). The company requires that all traffic between the two clouds be encrypted and inspected for threats. You need to recommend a solution that meets the following requirements: - Minimize latency. - Use Microsoft-provided security services where possible. - Ensure traffic is inspected at Layers 3-7. Which TWO options should you include in your design?

Select 2 answers
A.Azure Virtual WAN with a secured hub that includes Azure Firewall and Firewall Manager.
B.Azure Firewall with forced tunneling to an on-premises inspection appliance.
C.Azure Policy with built-in network security policies.
D.Azure Front Door Premium with Web Application Firewall (WAF) policy.
E.AWS Transit Gateway with AWS Network Firewall for inspection.
AnswersA, E

Azure Virtual WAN is a global transit networking service that interconnects VNets, branches, and remote sites through a full mesh of Microsoft-managed hubs. When deployed as a secured hub, it embeds Azure Firewall as a centralized, scalable L3-7 inspection point, and Firewall Manager enforces consistent security policies across all hubs and virtual networks. This architecture dynamically routes inter-cloud and branch traffic through the firewall, providing transit connectivity and comprehensive inspection that exactly matches the multicloud network security requirement.

Why this answer

Azure Virtual WAN with a secured hub integrates Azure Firewall and Firewall Manager to provide a centralized, Microsoft-managed inspection point for traffic between Azure and AWS. This design minimizes latency by routing inter-cloud traffic through Microsoft's global backbone rather than over the public internet, and it supports Layer 3-7 inspection via Azure Firewall's application and network rules. Similarly, on the AWS side, AWS Transit Gateway with AWS Network Firewall provides a centralized, managed inspection point for traffic between VPCs and other connected networks, including inter-cloud traffic.

It also minimizes latency by routing traffic through AWS's global infrastructure and supports Layer 3-7 inspection. Together, these two components satisfy all requirements: encrypted and inspected traffic between the two clouds, minimized latency, use of Microsoft-provided services where possible (Azure Firewall), and Layers 3-7 inspection on both sides.

Exam trap

Candidates may confuse Azure Front Door (a global load balancer and WAF for web traffic) with a general-purpose inter-cloud inspection solution, overlooking that it only handles HTTP/HTTPS and cannot inspect non-web protocols or traffic between cloud networks. Similarly, they might think only one cloud-side solution is needed, but in a multicloud environment, both sides must provide inspection for true end-to-end security.

Full explanation →
70
MCQmedium

A security architect needs to design a solution that provides a unified view of security alerts from multiple clouds (Azure, AWS, GCP) and on-premises systems. The solution must also support automated response using playbooks. Which Microsoft service should they use?

A.Microsoft Defender XDR
B.Microsoft Defender for Cloud
C.Microsoft Purview
D.Microsoft Sentinel
AnswerD

Microsoft Sentinel is a cloud-native SIEM and SOAR that natively ingests data from Azure and, via built-in connectors, from AWS, Google Cloud, other SaaS platforms, and on-premises sources such as syslog and CEF, allowing centralized multi-cloud log collection. Its analytical rules use Kusto Query Language to detect suspicious activity and trigger automated response playbooks built on Azure Logic Apps, providing real-time containment like device isolation or account disablement. Sentinel's architecture includes Common Event Format (CEF) and Syslog agents for on-premises, plus API connectors for AWS CloudTrail and GCP, making it the only option that fulfills the full multi-cloud SIEM/SOAR requirement with integrated UEBA and threat intelligence.

Why this answer

Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution that ingests security alerts from multiple clouds (Azure, AWS, GCP) and on-premises systems via connectors. It supports automated response through playbooks built on Azure Logic Apps, enabling unified alert management and remediation workflows.

Exam trap

The trap here is confusing Microsoft Defender for Cloud (a CSPM tool) with Microsoft Sentinel (a SIEM/SOAR), as both appear in the Azure portal and deal with security alerts, but only Sentinel provides native multi-cloud SIEM ingestion and automated playbook orchestration for cross-cloud incident response.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender XDR is an extended detection and response solution focused on correlating signals across Microsoft 365, endpoints, and identities, but it does not natively ingest alerts from AWS, GCP, or on-premises systems for a unified multi-cloud SIEM view. Option B is wrong because Microsoft Defender for Cloud is a cloud security posture management (CSPM) and workload protection platform that provides security recommendations and alerts primarily for Azure and hybrid environments, but it lacks the native multi-cloud SIEM ingestion and SOAR playbook automation of Sentinel. Option C is wrong because Microsoft Purview is a data governance, risk, and compliance solution (e.g., data classification, eDiscovery, insider risk management) and does not provide SIEM alert correlation or automated response playbooks for security incidents.

Full explanation →
71
MCQmedium

A company is using Azure Active Directory (Azure AD) for identity management. They want to implement a policy that requires all users to use multi-factor authentication (MFA) when accessing Office 365 from outside the corporate network. Which conditional access policy setting should they configure?

A.Assignments > Conditions > Client apps
B.Assignments > Conditions > Locations
C.Assignments > Conditions > Device platforms
D.Assignments > Conditions > Sign-in risk
AnswerB

Location condition can be used to enforce MFA for external networks.

Why this answer

The Locations condition in Azure AD Conditional Access allows administrators to define named locations (such as corporate IP ranges) and then require MFA when access originates from any location that is not trusted. By configuring a policy that targets 'All users' and 'All cloud apps' (or specifically Office 365), and setting the Locations condition to 'Any location' with the exclusion of the corporate network, the policy enforces MFA for all external access attempts. This directly meets the requirement to require MFA when accessing Office 365 from outside the corporate network.

Exam trap

The trap here is that candidates often confuse the Locations condition with the Sign-in risk condition, thinking that external access is inherently risky, but the question specifically asks for a policy based on network location, not risk level.

How to eliminate wrong answers

Option A is wrong because the Client apps condition controls which types of applications (browser, mobile app, legacy authentication) trigger the policy, not the network location of the user. Option C is wrong because the Device platforms condition filters based on the operating system (e.g., Windows, iOS, Android) and does not consider whether the request originates from inside or outside the corporate network. Option D is wrong because the Sign-in risk condition uses Azure AD Identity Protection to detect risky sign-in behavior (e.g., anonymous IP, leaked credentials) and is not designed to enforce MFA based purely on network location.

Full explanation →
72
MCQeasy

Your organization is implementing a zero-trust security model and needs to ensure that all access to cloud resources is verified in real-time. You plan to use Microsoft Entra ID Conditional Access. Which policy component enforces real-time verification of user identity and device compliance before granting access?

A.Enable Microsoft Secure Score
B.Use Azure AD Application Proxy
C.Conditional Access policy with conditions and grant controls
D.Assign users and groups to the policy
AnswerC

Conditional Access policies are the core enforcement mechanism for zero trust in Azure AD. They combine conditions such as user or group membership, location, device state, and sign-in risk with grant controls like requiring MFA, a compliant device, or a hybrid Azure AD joined device. These policies enforce real-time verification for every access attempt, ensuring that access is granted only when all configured conditions and controls are satisfied, aligning with the zero trust principle of 'verify explicitly'.

Why this answer

Conditional Access policies with conditions and grant controls enforce real-time verification by evaluating signals such as user identity, device compliance (via Microsoft Intune), and location before allowing access to cloud resources. The grant controls block or require multi-factor authentication (MFA) or device compliance, ensuring zero-trust principles of explicit verification and least privilege.

Exam trap

The trap here is that candidates confuse policy assignment (users/groups) with the enforcement mechanism (conditions and grant controls), thinking that merely assigning a policy to a user group enforces real-time verification, when in fact the conditions and grant controls are the components that perform the actual evaluation and access decision.

How to eliminate wrong answers

Option A is wrong because Microsoft Secure Score is a security posture measurement tool, not a policy component that enforces real-time access verification. Option B is wrong because Azure AD Application Proxy provides secure remote access to on-premises web applications, not real-time identity and device compliance checks for cloud resources. Option D is wrong because assigning users and groups to a policy defines scope but does not enforce real-time verification; the conditions and grant controls are the components that perform the actual evaluation and enforcement.

Full explanation →
73
MCQeasy

A company uses Microsoft Defender for Cloud Apps to discover and control Shadow IT. They want to block the use of a newly discovered unsanctioned app. What should they do?

A.Create a Conditional Access policy to block the app
B.Use Microsoft Purview Data Loss Prevention to block the app
C.Mark the app as unsanctioned in Defender for Cloud Apps
D.Block the app's domain in Microsoft Intune
AnswerC

Defender for Cloud Apps presents discovered apps in the Shadow IT dashboard, where an admin can mark an app as unsanctioned to actively block it. Unsanctioning is the native CASB control point that works with the Conditional Access App Control (reverse proxy) or app connectors to terminate sessions and prevent access to the app for all users. This is the exact feature designed to govern newly discovered unsanctioned cloud applications, and it works even for apps that are not federated with Microsoft Entra ID.

Why this answer

Marking an app as unsanctioned in Microsoft Defender for Cloud Apps is the direct mechanism to block access to a discovered Shadow IT app. When an app is marked unsanctioned, Defender for Cloud Apps automatically enforces a block by integrating with Conditional Access to prevent users from accessing the app, and it can also generate alerts and session controls. This action is specifically designed for the discovered app governance workflow within Defender for Cloud Apps.

Exam trap

The trap here is that candidates often assume creating a Conditional Access policy directly is the correct action, but the SC-100 exam tests the understanding that marking the app as unsanctioned in Defender for Cloud Apps is the prerequisite step that triggers the automatic Conditional Access policy enforcement.

How to eliminate wrong answers

Option A is wrong because creating a Conditional Access policy to block the app is not the first step; the app must first be marked as unsanctioned in Defender for Cloud Apps, which then automatically creates the necessary Conditional Access policy via the app governance integration. Option B is wrong because Microsoft Purview Data Loss Prevention (DLP) is designed to prevent data exfiltration and sensitive data sharing, not to block access to an entire unsanctioned app. Option D is wrong because blocking the app's domain in Microsoft Intune would only affect managed devices and does not address the broader Shadow IT discovery and control workflow that Defender for Cloud Apps provides.

Full explanation →
74
MCQhard

Your organization uses Microsoft Sentinel as a SIEM. The security team wants to use Microsoft Copilot for Security to assist in incident investigation. You need to ensure that Copilot can access Sentinel data while meeting compliance requirements. Which integration should you configure?

A.Deploy a playbook to query Sentinel data
B.Enable Microsoft Copilot for Security plugin for Sentinel
C.Enable Sentinel's Threat Intelligence connectors
D.Use Microsoft Defender for Cloud
AnswerB

Enabling the Microsoft Copilot for Security plugin for Sentinel is the direct, secure integration that lets Copilot query and interact with Sentinel data using natural language. When enabled, a security analyst can ask Copilot questions like 'summarize the most recent high-severity alerts' or 'show all open incidents involving user X,' and Copilot translates that into KQL queries against Sentinel's underlying Log Analytics workspace. This plugin explicitly bridges Copilot to Sentinel, providing incident summaries, guided investigations, and context-aware responses, which is exactly what the organization needs to leverage Copilot as a SIEM interface.

Why this answer

The Microsoft Copilot for Security plugin for Sentinel is the correct integration because it enables Copilot to directly query and analyze Sentinel data through a native, compliant connection. This plugin uses Sentinel's API and role-based access control (RBAC) to ensure that Copilot only accesses data the user is authorized to see, meeting compliance requirements without additional data movement.

Exam trap

The trap here is that candidates often confuse enabling Threat Intelligence connectors (Option C) with granting data access, but those connectors only import external threat data and do not provide Copilot with read access to Sentinel's internal logs or incidents.

How to eliminate wrong answers

Option A is wrong because deploying a playbook to query Sentinel data introduces unnecessary complexity and latency; playbooks are designed for automated response workflows, not for providing real-time, compliant data access to Copilot. Option C is wrong because enabling Sentinel's Threat Intelligence connectors only ingests external threat intelligence feeds into Sentinel, it does not grant Copilot access to Sentinel's existing security data or logs. Option D is wrong because Microsoft Defender for Cloud is a separate cloud security posture management (CSPM) tool that does not natively integrate with Copilot for Security to access Sentinel data; it focuses on workload protection, not SIEM data access.

Full explanation →
75
MCQeasy

A SOC analyst needs to investigate a potential privilege escalation using Azure AD roles. Which Microsoft 365 Defender data source would be most useful to review?

A.Microsoft 365 Defender identity logs
B.Azure Active Directory audit logs
C.Microsoft Defender for Cloud Apps logs
D.Microsoft 365 audit logs
AnswerB

Azure AD audit logs (now part of Microsoft Entra ID) provide a comprehensive, immutable record of directory events, including role assignments, role activations, and permission changes. These logs precisely capture the actor, target, timestamp, and metadata for every privilege-modification action, making them the definitive source for tracing how a user acquired elevated rights or escalated privileges.

Why this answer

Azure AD audit logs (now part of the Azure Monitor / Microsoft Entra audit logs) are the authoritative source for tracking changes to Azure AD roles, including role assignments, activations of Privileged Identity Management (PIM) roles, and modifications to directory roles. Since the question specifically involves privilege escalation using Azure AD roles, these logs contain the necessary details such as who assigned a role, when, and from which IP address, making them the most directly relevant data source.

Exam trap

Microsoft often tests the distinction between Azure AD audit logs (which track directory configuration changes like role assignments) and Microsoft 365 audit logs (which track user activity across workloads), leading candidates to mistakenly choose the broader Microsoft 365 audit logs when the question specifically targets Azure AD role changes.

How to eliminate wrong answers

Option A is wrong because Microsoft 365 Defender identity logs (derived from Microsoft Defender for Identity) focus on on-premises Active Directory security events and lateral movement detection, not Azure AD role assignments or changes. Option C is wrong because Microsoft Defender for Cloud Apps logs primarily track user activities within cloud applications (e.g., file downloads, app permissions) and do not natively capture Azure AD role assignment events. Option D is wrong because Microsoft 365 audit logs cover a broad range of user and admin activities across Exchange, SharePoint, and Teams, but they do not include the granular Azure AD role assignment and activation events that are specifically recorded in Azure AD audit logs.

Full explanation →

Page 1 of 3

Page 2

All pages

123

Practice SC-100 by domain

Target a specific domain to shore up weak areas.

Design solutions that align with security best practices and prioritiesDesign security operations, identity, and compliance capabilitiesDesign security solutions for infrastructureDesign security solutions for applications and data
See all domains with question counts →