I85PREP
⌘ K
SC-100 study materials
SC-100 study resources

SC-100 practice questions

One question at a time. Build your SC-100 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Design solutions that align with security best practices and priorities

Which of the following is one of the three guiding principles of the Zero Trust security model?

  1. Verify explicitly Correct answer.
  2. Authenticate a user once per session and cache the decision
  3. Rely primarily on network perimeter controls
  4. Trust traffic that originates inside the corporate network

Explanation

Zero Trust is built on three principles: verify explicitly, use least privileged access, and assume breach. Every access request is authenticated and authorized using all available signals, regardless of where it originates.

Question 2Design solutions that align with security best practices and priorities

Under the shared responsibility model for an infrastructure-as-a-service workload in Azure, which task belongs to the customer?

  1. Patching the guest operating system Correct answer.
  2. Securing the hypervisor layer
  3. Protecting the physical hosts from tampering
  4. Maintaining the physical datacenter network fabric

Explanation

In IaaS the provider is responsible for the physical hosts, network, and hypervisor, while the customer owns everything from the guest operating system upward, including patching, middleware, applications, and data.

Question 3Design solutions that align with security best practices and priorities

What does Microsoft Secure Score primarily represent?

  1. The percentage of users who are enrolled in multi-factor authentication
  2. The number of security incidents that were resolved in the last 30 days
  3. A relative measure of security posture against recommended actions Correct answer.
  4. The count of open vulnerabilities detected across all subscriptions by Defender for Cloud

Explanation

Secure Score aggregates recommended security actions across identity, data, devices, applications, and infrastructure into a relative score. Organizations use it to track posture improvements over time and to compare against similar organizations.

Question 4Design solutions that align with security best practices and priorities

What is the primary purpose of a defense-in-depth strategy?

  1. To reduce the number of separate policies that administrators must maintain
  2. To replace continuous monitoring with preventive controls only
  3. To centralize every security control into a single enforcement appliance
  4. To slow an attacker moving through several independent layers Correct answer.

Explanation

Defense in depth layers controls across identity, network, compute, application, and data so that a failure or bypass of one layer does not result in full compromise. The goal is to delay and detect an attacker's progression.

Question 5Design solutions that align with security best practices and priorities

A team needs occasional, time-bound access to the Owner role on an Azure subscription. Which approach best applies least privilege?

  1. Permanent Owner assignments at the subscription scope for every administrator and service desk agent
  2. Eligible Privileged Identity Management assignments activated just in time with approval Correct answer.
  3. A single shared privileged account credential distributed to all team members
  4. Permanent Contributor at the management group scope for the whole operations department

Explanation

Privileged Identity Management removes standing access by making roles eligible and activating them only when needed, with approval, justification, and time limits. This limits both the duration and the blast radius of privileged access.

Question 6Design solutions that align with security best practices and priorities

Which design outcome best reflects the Zero Trust principle of assume breach?

  1. Treating any VPN-connected device as fully trusted for all resources
  2. Segmenting workloads so a compromise cannot spread laterally Correct answer.
  3. Granting broad access after a single strong authentication event
  4. Extending user session lifetimes to reduce the number of authentication prompts

Explanation

Assume breach means designing as if an attacker is already inside: minimize blast radius, segment networks and workloads, encrypt data, and monitor continuously. Containment limits how far an intrusion can spread.

Question 7Design solutions that align with security best practices and priorities

What is the Microsoft cloud security benchmark?

  1. Prescriptive security recommendations mapped to control frameworks Correct answer.
  2. A certification audit template that an organization uses to prepare for an ISO 27001 assessment
  3. A licensing program that grants access to the Microsoft Defender for Cloud plans
  4. A curated list of Azure virtual machine sizes that are approved for use in regulated workloads

Explanation

The Microsoft cloud security benchmark provides prescriptive, framework-mapped security recommendations for Azure and multicloud workloads. Defender for Cloud uses it as the basis for its regulatory and benchmark assessments.

Question 8Design solutions that align with security best practices and priorities

At which point in a solution's lifecycle is threat modeling most effective and least costly?

  1. During the design phase, before code is written Correct answer.
  2. During the annual penetration test
  3. After a security incident has been detected in production
  4. When the solution is being decommissioned

Explanation

Threat modeling identifies design flaws such as missing trust boundaries or weak authentication while changes are still cheap to make. Remediation cost grows sharply with each later lifecycle phase.

Question 9Design solutions that align with security best practices and priorities

An organization wants Zero Trust policy decisions for sign-ins based on user, device, location, and risk signals. Which control is the primary enforcement point?

  1. Azure network security groups
  2. Microsoft Purview data loss prevention policies
  3. Microsoft Entra Conditional Access policies Correct answer.
  4. Azure Policy definitions at the subscription scope

Explanation

Conditional Access is the policy engine that evaluates signals at sign-in and enforces decisions such as block, require multifactor authentication, or require a compliant device. It is the central control plane for identity-based Zero Trust enforcement.

Question 10Design solutions that align with security best practices and priorities

Which statement correctly distinguishes Azure Policy from Azure RBAC?

  1. Both are interchangeable, and Azure Policy is simply the newer name for RBAC
  2. Azure Policy enforces resource properties, while Azure RBAC controls which users can perform operations Correct answer.
  3. Azure Policy applies only to on-premises resources, while RBAC applies only to the cloud
  4. Azure RBAC enforces resource configuration rules, while Azure Policy controls who can perform actions

Explanation

RBAC answers who can do what with which resource, governing actions on the control plane. Azure Policy evaluates resource properties and enforces guardrails such as allowed locations or required settings.

Question 11Design solutions that align with security best practices and priorities

A security team has hundreds of Defender for Cloud recommendations. Which approach best prioritizes remediation?

  1. Fix the recommendations that have the longest descriptions first
  2. Remediate in alphabetical order based on the recommendation display name
  3. Prioritize by attack path analysis and risk to high-value resources Correct answer.
  4. Remediate only the recommendations that affect non-production test subscriptions

Explanation

Risk-based prioritization focuses remediation where an attacker could actually reach and impact valuable assets. Attack path analysis shows which combinations of findings create exploitable routes rather than treating all findings as equal.

Question 12Design solutions that align with security best practices and priorities

Which Microsoft Sentinel capability provides automated, repeatable incident response actions such as isolating a device or posting to a collaboration channel?

  1. Analytics rules
  2. Workbooks
  3. Log Analytics workspace retention settings
  4. Automation rules that trigger playbooks Correct answer.

Explanation

Automation rules can trigger playbooks, which are built on Logic Apps, to run standardized response steps when an incident or alert is created. This reduces mean time to respond and removes manual repetition.

Question 13Design solutions that align with security best practices and priorities

A regulation requires that the organization control and rotate the keys protecting data at rest in Azure SQL Database. Which design meets this requirement?

  1. Service-managed keys that the platform rotates on a fixed schedule
  2. Application-level keys committed alongside the code in the source repository
  3. Transport Layer Security enforced for every client connection to the database
  4. Customer-managed keys in Azure Key Vault referenced by transparent data encryption Correct answer.

Explanation

Transparent data encryption supports customer-managed keys held in Key Vault or a managed hardware security module, giving the organization control over key lifecycle, rotation, and revocation. Service-managed keys do not give the customer that control.

Question 14Design solutions that align with security best practices and priorities

Which design element enforces a consistent security baseline across all subscriptions in an Azure landing zone?

  1. A shared ExpressRoute circuit used by all environments
  2. A single subscription that hosts all production workloads
  3. Per-workload resource groups with custom role assignments
  4. Management groups with assigned policy initiatives Correct answer.

Explanation

Management groups let an organization apply policy initiatives and role assignments once and inherit them to every child subscription. The Cloud Adoption Framework security design area relies on this hierarchy to deliver consistent guardrails.

Question 15Design solutions that align with security best practices and priorities

Users must be able to see a document's classification, and the protection must travel with the file wherever it goes. Which capability accomplishes this?

  1. A file naming convention that prefixes every file name with its data classification
  2. Microsoft Purview sensitivity labels with encryption applied to content Correct answer.
  3. A banner displayed on each SharePoint site that describes the site's sensitivity level
  4. An email signature block that states the sender's data classification

Explanation

Sensitivity labels persist as metadata on the file and can apply encryption and usage restrictions that remain enforced when the file leaves the source system. Labels also surface the classification to users in supported applications.

Question 16Design solutions that align with security best practices and priorities

Which control most directly reduces the attack surface of administrative access to Azure resources?

  1. Granting permanent Owner rights at the tenant root scope to the operations team
  2. Allowing inbound management ports from any address on the internet
  3. Sharing administrator credentials with the service desk for faster resolution
  4. Just-in-time, just-enough admin access with phishing-resistant credentials Correct answer.

Explanation

Eliminating standing privilege and requiring strong, phishing-resistant authentication removes the two most common paths attackers use to obtain and abuse administrative control. Access is granted only for the task and duration required.

Question 17Design solutions that align with security best practices and priorities

In the NIST incident response lifecycle, which phase immediately follows detection and analysis?

  1. Containment, eradication, and recovery Correct answer.
  2. Post-incident activity
  3. Risk assessment and threat modeling
  4. Preparation

Explanation

The lifecycle proceeds from preparation to detection and analysis, then to containment, eradication, and recovery, and finally to post-incident activity. Containment aims to stop the spread before the threat is removed and systems restored.

Question 18Design solutions that align with security best practices and priorities

An organization runs workloads in Azure, AWS, and GCP and wants a single view of misconfigurations. Which design is appropriate?

  1. Move every workload to Azure before starting any posture assessment
  2. Deploy a separate third-party scanner in each cloud and aggregate the reports by hand each month
  3. Rely only on each cloud provider's native console for posture reporting
  4. Connect AWS and GCP accounts to Defender for Cloud with native connectors for one unified view Correct answer.

Explanation

Defender for Cloud provides native multicloud connectors that surface AWS and GCP findings alongside Azure findings in one secure score and recommendation set. This enables consistent prioritization across providers.

Question 19Design solutions that align with security best practices and priorities

New subscriptions must not allow public IP addresses on storage accounts. Which design enforces this at scale?

  1. An email reminder sent to subscription owners at the start of each quarter
  2. A shared responsibility document distributed to each workload team
  3. An Azure Policy deny effect assigned at the management group scope Correct answer.
  4. A monthly manual review of every storage account in the subscription

Explanation

A policy definition with a deny effect blocks noncompliant resource creation and updates before they are committed. Assigning it at the management group scope inherits the control to every current and future subscription.

Question 20Design solutions that align with security best practices and priorities

Which design best protects privileged access in a hybrid environment?

  1. Storing break-glass credentials in a shared spreadsheet on the file server
  2. Using a single account for daily email and directory administration
  3. Allowing permanent Global Administrator assignments to every IT staff member
  4. Separate admin accounts with tiered administration and PIM Correct answer.

Explanation

Dedicated administrative accounts prevent a compromised productivity session from carrying privileged rights, and tiered administration prevents lower-tier compromise from reaching higher-tier assets. PIM removes standing privilege by making activation time-bound and approved.

Question 21Design solutions that align with security best practices and priorities

A Zero Trust network design must prevent lateral movement between workloads in the same virtual network. Which approach best meets the requirement?

  1. Place all workloads in one subnet with a single allow-all network security group rule
  2. Rely on the perimeter firewall to inspect all internal east-west traffic
  3. Micro-segment with allow-listed flows and continuous monitoring Correct answer.
  4. Use a shared jump host with unrestricted access to every subnet

Explanation

Micro-segmentation restricts traffic to only the flows each workload genuinely requires, so a compromised host cannot freely reach its neighbors. Continuous monitoring validates that the allowed flows remain accurate as workloads change.

Question 22Design solutions that align with security best practices and priorities

Secure Score falls when a recommendation is ignored, but the workload owner documents that a compensating control makes the residual risk acceptable. What is the best governance response?

  1. Force the change anyway without reviewing the compensating control evidence
  2. Delete the affected resources so that the recommendation no longer appears
  3. Suppress the recommendation permanently without recording any documentation
  4. Record a time-bound risk acceptance with compensating control evidence Correct answer.

Explanation

Security governance allows documented exceptions when residual risk is understood and accepted by an accountable owner. A good risk acceptance records the owner, justification, compensating control, and an expiry date so the decision is revisited.

Question 23Design solutions that align with security best practices and priorities

An organization must demonstrate alignment with a regulatory standard and track remediation work. Which Microsoft capability should the design include?

  1. Microsoft Defender for Identity sensor deployment on domain controllers
  2. Purview Compliance Manager assessments with assigned improvement actions Correct answer.
  3. Azure Advisor cost optimization recommendations reviewed monthly
  4. Microsoft 365 message center posts forwarded to the security team

Explanation

Compliance Manager provides assessment templates mapped to regulations and standards, scores the organization's posture, and lets improvement actions be assigned to owners. This creates auditable evidence of remediation progress.

Question 24Design solutions that align with security best practices and priorities

A DevSecOps pipeline must ensure that deployed container images were produced by the trusted build pipeline and have not been altered. Which design achieves this?

  1. Allow developers to push directly to production using floating tags
  2. Rely on network isolation of the container registry
  3. Scan images once during development and never scan them again
  4. Sign images at build time and verify signatures at deploy time Correct answer.

Explanation

Signature verification at admission ensures that only artifacts produced by the trusted pipeline can run, which protects against tampering and unauthorized images. Provenance attestation extends this by recording how and from what source the image was built.

Question 25Design solutions that align with security best practices and priorities

An enterprise wants to detect and investigate threats across on-premises, multicloud, and Microsoft 365 signals from a single platform. Which design aligns best?

  1. Collect logs separately on each server and review them manually after incidents occur
  2. Enable only default Defender for Cloud alerts and export them to CSV each week
  3. Rely on each team's local SIEM with no central correlation or retention
  4. Ingest signals into Microsoft Sentinel with data connectors and analytics rules Correct answer.

Explanation

Sentinel centralizes signals from many sources through data connectors and applies analytics rules to correlate them into incidents for investigation. Central retention and correlation are what make cross-domain detection possible.

Question 26Design solutions that align with security best practices and priorities

An organization is designing layered controls for a three-tier application. Which layer limits how far an attacker can move after compromising a front-end web server?

  1. Network controls that restrict traffic between application tiers Correct answer.
  2. Data controls that encrypt the database at rest
  3. Application controls that validate user input
  4. Identity controls that require multifactor authentication for administrators

Explanation

Defense in depth places independent controls at each layer so a single failure is not fatal. Restricting traffic between tiers limits east-west movement from a compromised host. Encryption at rest and input validation reduce other risks but do not contain a compromised server that already holds valid credentials.

Question 27Design solutions that align with security best practices and priorities

A company migrates an on-premises database to Azure SQL Database, a PaaS offering. Which security responsibility remains with the customer?

  1. Configuring database authentication and auditing Correct answer.
  2. Maintaining the underlying hypervisor
  3. Patching the guest operating system and database engine
  4. Securing the physical datacenter hosting the service

Explanation

In the shared responsibility model for PaaS, the provider manages the physical infrastructure, hypervisor, and platform patching, while the customer remains accountable for data, identities, and configuration. Authentication, authorization, and auditing settings for the database are customer configuration.

Question 28Design solutions that align with security best practices and priorities

Which design most closely applies the principle of least privilege to administrative access?

  1. Assigning eligible, time-bound roles activated only when needed Correct answer.
  2. Sharing a single privileged account among administrators
  3. Assigning permanent Global Administrator to the operations team
  4. Granting Contributor at the tenant root scope to simplify management

Explanation

Least privilege means granting only the permissions required, for only as long as required. Eligible roles activated on demand limit standing access and reduce the window an attacker can exploit. Permanent, shared, or broadly scoped assignments all create excessive standing privilege.

Question 29Design solutions that align with security best practices and priorities

An attacker modifies transaction amounts in a financial system without authorization. Which security objective is primarily violated?

  1. Availability
  2. Integrity Correct answer.
  3. Confidentiality
  4. Non-repudiation

Explanation

Integrity ensures data is accurate and has not been altered by unauthorized parties. Tampering with transaction values is a direct integrity violation. Confidentiality concerns disclosure, availability concerns uptime, and non-repudiation concerns proving who performed an action.

Question 30Design solutions that align with security best practices and priorities

Which control protects data from interception while it travels between a user's browser and a web application over the internet?

  1. TLS with a trusted server certificate Correct answer.
  2. BitLocker full-volume encryption
  3. Database transparent data encryption
  4. Azure Storage service-side encryption

Explanation

Encryption in transit uses protocols such as TLS to protect data on the wire, and a trusted certificate lets the client verify the server identity. Disk, storage, and database encryption protect data at rest and do not secure the network path.

Question 31Design solutions that align with security best practices and priorities

In a threat model, which element marks where data crosses between components that have different levels of trust?

  1. Trust boundary Correct answer.
  2. Mitigation register
  3. Risk rating matrix
  4. Data flow diagram process node

Explanation

Trust boundaries highlight transitions between zones of differing trust, such as the internet and an internal network, and are where authentication, validation, and monitoring must be enforced. Process nodes depict components, a risk matrix prioritizes findings, and a mitigation register tracks remediation work.

Question 32Design solutions that align with security best practices and priorities

An application running on an Azure virtual machine must read secrets from Azure Key Vault. The design must avoid storing any credential on the VM. Which approach should be used?

  1. Assign a managed identity to the VM and grant it Key Vault access Correct answer.
  2. Enable public network access on the vault and use a shared access signature
  3. Store a service principal secret in an environment variable
  4. Embed the Key Vault access key in the application source code

Explanation

Managed identities provide an automatically rotated credential managed by the platform, so no secret is stored on the VM. The identity is then authorized to read secrets from the vault. Storing secrets in variables, source code, or broadly accessible shared signatures reintroduces credential exposure.

Question 33Design solutions that align with security best practices and priorities

A storage account must be accessible only from a specific virtual network and must not be reachable over the public internet. Which design accomplishes this?

  1. Create a private endpoint and disable public network access Correct answer.
  2. Enable storage account firewalls with the 'allow trusted Microsoft services' exception
  3. Use a shared access signature scoped to the storage account
  4. Configure a service endpoint and allow all Azure services

Explanation

A private endpoint places the service on a private IP inside the virtual network, and disabling public network access removes the internet-reachable path. Service endpoints still expose a public endpoint, and shared signatures control authorization rather than network reachability.

Question 34Design solutions that align with security best practices and priorities

Guest users from partner organizations have access to Microsoft 365 resources. The security team must confirm every quarter that each guest still requires access, with automatic removal if no response. Which capability should be used?

  1. Conditional Access sign-in frequency
  2. Privileged Identity Management activation
  3. Microsoft Defender for Cloud Apps session policies
  4. Microsoft Entra access reviews Correct answer.

Explanation

Access reviews provide recurring attestation of continued need, and they can automatically remove access when reviewers do not respond. Conditional Access controls how sessions are established, PIM governs role activation, and session policies control in-session activity.

Question 35Design solutions that align with security best practices and priorities

Microsoft Sentinel must generate an incident when a user signs in from two countries within an impossible travel interval. Which component implements this logic?

  1. Watchlist
  2. Workbook
  3. Analytics rule Correct answer.
  4. Data connector

Explanation

Analytics rules contain the detection logic that correlates events and creates alerts or incidents. Data connectors only ingest logs, workbooks visualize data, and watchlists supply reference data used by rules.

Question 36Design solutions that align with security best practices and priorities

An organization must prevent employees from emailing documents that contain payment card numbers to external recipients while allowing internal sharing. Which capability should the design use?

  1. A Purview DLP policy with a sensitive information type Correct answer.
  2. A mail flow rule that deletes all messages with attachments
  3. Sensitivity labels applied manually by users
  4. SharePoint site-level sharing restrictions

Explanation

A data loss prevention policy uses sensitive information types to detect payment card numbers and can block or restrict only external sharing. Blanket mail deletion is disruptive, site sharing settings do not cover email, and manual labels do not reliably detect sensitive content.

Question 37Design solutions that align with security best practices and priorities

A hub-and-spoke topology must apply consistent outbound FQDN filtering to all spokes and log all egress traffic centrally. Which design element meets the requirement?

  1. An Azure Firewall in the hub routing all spoke egress Correct answer.
  2. Service endpoints from each spoke to Azure services
  3. Azure DDoS Protection on the hub virtual network
  4. Network security groups applied to every spoke subnet

Explanation

Azure Firewall in the hub provides centralized FQDN-based egress filtering and consolidated logging when spoke traffic is routed through it. Network security groups filter by IP and port, DDoS Protection defends against volumetric attacks, and service endpoints do not inspect outbound traffic.

Question 38Design solutions that align with security best practices and priorities

An organization wants to detect Kerberoasting, Pass-the-Hash, and reconnaissance against domain controllers in a hybrid Active Directory environment. Which tool is designed for this?

  1. Microsoft Defender for Cloud Apps
  2. Microsoft Entra ID Protection
  3. Azure Network Watcher
  4. Microsoft Defender for Identity Correct answer.

Explanation

Microsoft Defender for Identity monitors domain controller traffic and identity signals to detect advanced on-premises Active Directory attacks such as Kerberoasting and Pass-the-Hash. The other tools focus on cloud app usage, cloud identity risk, or network diagnostics.

Question 39Design solutions that align with security best practices and priorities

An organization wants backups to remain recoverable even if an attacker gains administrative access to the backup solution and tries to delete them. Which design element is most important?

  1. Backup encryption with a password stored on the server
  2. Daily full backups to the same storage account
  3. Immutable backups with soft delete enabled Correct answer.
  4. Backup jobs scheduled during off-peak hours

Explanation

Immutable storage prevents deletion or alteration for a retention period, and soft delete allows recovery of deleted backup items, which directly counters an attacker who reaches the backup console. Encryption alone and scheduling choices do not stop a privileged attacker from deleting data.

Question 40Design solutions that align with security best practices and priorities

A DevSecOps pipeline must identify insecure code patterns in source code before the application is deployed, without running the application. Which control should be added?

  1. Penetration testing
  2. Dynamic application security testing
  3. Runtime application self-protection
  4. Static application security testing Correct answer.

Explanation

Static analysis inspects source or compiled code without executing it, making it suitable for early pipeline gates. Dynamic testing and penetration testing require a running application, and runtime self-protection operates in production.

Question 41Design solutions that align with security best practices and priorities

A newly disclosed vulnerability affects a widely used open-source library. Which artifact best enables the organization to determine quickly which applications are affected?

  1. A software bill of materials for each application Correct answer.
  2. A network topology diagram
  3. A vulnerability scan report from last year
  4. An incident response plan

Explanation

A software bill of materials inventories the components and versions in each application, enabling rapid matching against a newly disclosed vulnerability. Old scan reports are stale, topology shows network paths, and the response plan describes process rather than component inventory.

Question 42Design solutions that align with security best practices and priorities

A regulation requires that personal data of EU residents be stored and processed only within EU datacenters. Which design decision addresses this requirement?

  1. Encrypting all data with customer-managed keys
  2. Enabling Microsoft Defender for Cloud regulatory compliance
  3. Using private endpoints for all PaaS services
  4. Deploying workloads to EU regions only Correct answer.

Explanation

Data residency is addressed by choosing deployment regions and restricting replication and failover targets to the permitted geography. Encryption, compliance dashboards, and private connectivity improve protection and visibility but do not control where data is stored.

Question 43Design solutions that align with security best practices and priorities

Before deploying Microsoft 365 Copilot, an organization discovers that many SharePoint sites contain sensitive files shared with 'Everyone'. Which design step should be taken first to reduce the risk of Copilot surfacing that content?

  1. Disable Copilot for all users until the next fiscal year
  2. Apply a DLP policy that blocks all external sharing
  3. Enable audit logging for SharePoint
  4. Reviewing and restricting existing site permissions Correct answer.

Explanation

Copilot surfaces content that a user already has permission to access, so the primary risk is pre-existing oversharing. Remediating permissions at the site and document level reduces what any user, and therefore Copilot, can retrieve. DLP and audit logging are useful supplements but do not correct excessive read access.

Question 44Design solutions that align with security best practices and priorities

An organization deploys Conditional Access policies that require phishing-resistant MFA for all administrators. Which design element should be included to preserve access if the identity provider or MFA service is unavailable?

  1. Exempting the entire IT department from Conditional Access
  2. Storing administrator credentials in a team wiki
  3. A shared administrator account protected by a long password
  4. Monitored emergency access accounts excluded from policy Correct answer.

Explanation

Emergency access accounts, excluded from Conditional Access and tightly controlled, allow recovery when the normal authentication path fails. They should be cloud-only, use strong credentials stored securely, and be monitored so any use triggers review. Broad exemptions or shared accounts create standing risk.

Question 45Design solutions that align with security best practices and priorities

A senior executive's session token is stolen by an infostealer and replayed from an attacker-controlled device. Which control most directly reduces this risk for a high-value application?

  1. Enabling self-service password reset
  2. Increasing password length to 20 characters
  3. Requiring MFA at sign-in only
  4. Device-bound token protection policy Correct answer.

Explanation

Token theft bypasses sign-in prompts because the attacker reuses an already issued token. A Conditional Access token protection policy binds the token to the device so a copied token cannot be replayed elsewhere. Password changes and sign-in MFA do not invalidate a session token already in the attacker's hands.

Question 46Design solutions that align with security best practices and priorities

A workload processes highly sensitive data in memory, and the organization wants protection from the cloud operator while the data is being processed. Which technology addresses this requirement?

  1. Confidential computing with hardware-based enclaves Correct answer.
  2. Azure Disk Encryption
  3. Azure Private Link
  4. TLS 1.3 for all connections

Explanation

Confidential computing uses hardware-based trusted execution environments to protect data in use, including from the cloud operator. Disk encryption and TLS protect data at rest and in transit respectively, and Private Link only changes network exposure.

Question 47Design security operations, identity, and compliance capabilities

Your company is deploying Microsoft Sentinel as its SIEM. You need to detect suspicious activity by correlating events from multiple connected sources and generating incidents automatically. Which Sentinel component should you configure?

  1. Data connectors
  2. Playbooks
  3. Workbooks
  4. Analytics rules Correct answer.

Explanation

Analytics rules run scheduled or near-real-time queries against ingested data, correlate events across sources, and create alerts and incidents when conditions match. Connectors bring data in, and playbooks act only after an incident exists.

Question 48Design security operations, identity, and compliance capabilities

Contoso wants to require multifactor authentication only when users sign in from outside its trusted office IP ranges. Which Entra ID capability should you use?

  1. Conditional Access policies Correct answer.
  2. Security defaults
  3. Privileged Identity Management
  4. Access reviews

Explanation

Conditional Access evaluates signals such as user, location, device, and application, and can enforce MFA only when the location condition falls outside the named trusted ranges. Security defaults apply a fixed baseline to everyone and cannot be scoped.

Question 49Design security operations, identity, and compliance capabilities

Administrators must activate the Global Administrator role only when needed, with approval and a maximum duration of four hours. Which Entra ID feature provides this?

  1. Microsoft Defender for Identity
  2. Entitlement management
  3. Conditional Access
  4. Privileged Identity Management Correct answer.

Explanation

PIM makes users eligible for a role and requires just-in-time activation, optionally with approval and a defined maximum activation duration, after which the role assignment expires automatically.

Question 50Design security operations, identity, and compliance capabilities

A regulation requires that project documents be retained for seven years after creation and then deleted, and users must classify each document themselves. What should you create in Microsoft Purview?

  1. A retention policy scoped to the SharePoint site
  2. A sensitivity label with encryption
  3. A retention label published to the site Correct answer.
  4. A DLP policy for the SharePoint site

Explanation

A retention label carries retention and deletion settings and is applied by users, which satisfies the requirement for user-driven classification. A retention policy is applied automatically to everything at a location and gives users no classification choice.