Free SC-100 practice questions

A bank wants its control-plane administrators to authenticate to Microsoft Entra ID with a phishing-resistant method that uses the X.509 certificates already issued to staff by the bank's own public key infrastructure, without standing up Active Directory Federation Services and without depending on a federated on-premises identity provider to evaluate the certificate. The design must also ensure that, for the sensitive administrative applications, every sign-in is forced to use that phishing-resistant method rather than merely allowing it. Which two design elements together satisfy this requirement? Select TWO.

• AEnable Microsoft Entra certificate-based authentication so the cloud identity service validates the user's X.509 certificate directly against the configured certificate authorities as a phishing-resistant primary authentication method.check_circle Correct
• BConfigure Active Directory Federation Services certificate authentication and federate the Microsoft Entra tenant to it so that the on-premises federation servers evaluate each administrator's certificate before issuing a token to the cloud.
• CCreate a Conditional Access policy that grants access to the administrative applications when multifactor authentication is satisfied, allowing any registered method including push notifications and one-time passcodes to complete the sign-in.
• DCreate a Conditional Access policy targeting the administrative applications that requires a phishing-resistant authentication strength as the grant control, so only certificate-based or equivalent phishing-resistant methods complete the sign-in.check_circle Correct

Why A is correct: Microsoft Entra certificate-based authentication lets the cloud service itself validate the smart-card or soft certificate against trusted certificate authorities, delivering phishing-resistant primary authentication with no federation server in the path, which is exactly what the requirement needs.

Why B is wrong: Federated certificate authentication is a valid phishing-resistant approach in older designs, but it reintroduces the Active Directory Federation Services dependency the requirement explicitly rules out, so it cannot be part of the answer.

Why C is wrong: Requiring generic multifactor authentication is tempting because it raises assurance, but it permits phishable methods such as push and passcodes and does not force the phishing-resistant method the requirement mandates, so it fails the explicit-method condition.

Why D is correct: A Conditional Access authentication strength set to phishing-resistant forces every sign-in to the administrative applications to use a phishing-resistant method, turning certificate-based authentication from merely available into mandatory, which satisfies the second half of the requirement.

An architect is designing how engineers will perform identity control-plane administration so that the design embodies both Zero Trust assume-breach and the enterprise access model: no privilege should be held when it is not in use, and the origin from which administration occurs must not double as a high-risk productivity surface. Which TWO design elements together satisfy both intentions? Select TWO.

• AMake the high-impact directory roles eligible rather than active in Microsoft Entra Privileged Identity Management, so engineers hold no standing control-plane privilege and must activate just in time with justification and audit.check_circle Correct
• BApply a Conditional Access policy that requires multifactor authentication for the engineers' everyday laptops before those same laptops are used to reach the administrative portals.
• CSchedule recurring access reviews over the directory roles so that reviewers periodically recertify each engineer's continued need and remove assignments that are no longer attested.
• DRequire that control-plane administration is performed only from hardened, dedicated privileged access workstations that block general web browsing and email and are enforced as the sole permitted origin for those tasks.check_circle Correct

Why A is correct: Eligibility in Privileged Identity Management removes standing privilege and forces time-bound, justified, audited activation, which directly delivers the assume-breach intent that no control-plane privilege exists between genuine uses.

Why B is wrong: Multifactor on the everyday laptop strengthens sign-in and is tempting because it gates admin access, but it leaves administration originating from a device that also browses the web and reads email, so it satisfies neither the no-standing-privilege intent nor the clean-origin intent.

Why C is wrong: Access reviews recertify membership and are appealing because they prune stale privilege, but between reviews the access is fully standing and they place no constraint on the device used for administration, so neither stated intention is met.

Why D is correct: A dedicated privileged access workstation removes the high-risk productivity surface from the administration origin and is enforced as the only device permitted for control-plane tasks, which directly delivers the clean-origin intent the design requires.

A regulator imposes a new standard whose obligations are mixed: some are technical controls that must be continuously evaluated against the live configuration of the organisation's Azure resources, while others are procedural controls that require a named owner, documented evidence of testing, and a score the board can review. The architect must choose the two design elements that together satisfy both halves of the standard. Select TWO.

• AAdd the standard to the Microsoft Defender for Cloud regulatory compliance dashboard so its technical controls map to continuous assessments of the live Azure resource configuration.check_circle Correct
• BStream all Azure activity and configuration logs into Microsoft Sentinel and write analytics rules that alert whenever a resource drifts from the standard's technical controls.
• CAuthor one Azure Policy initiative covering every control in the standard, technical and procedural alike, and use the policy compliance percentage as the single evidence of conformance.
• DBuild a custom Microsoft Purview Compliance Manager assessment for the standard so each procedural control has an assigned owner, attached test evidence, and a contribution to the score.check_circle Correct

Why A is correct: The Microsoft Defender for Cloud regulatory compliance dashboard continuously evaluates Azure resource configuration against a standard's controls and scores them, which satisfies the technical, configuration-based half of the obligation.

Why B is wrong: Microsoft Sentinel can detect drift through analytics and is tempting for continuous monitoring, but a SIEM produces alerts rather than a maintained control-mapped compliance score, so it does not deliver the scored regulatory posture the standard requires.

Why C is wrong: Azure Policy evaluates resource settings and underpins assessments, which makes it a plausible single answer, but it cannot capture procedural controls that need an owner and manual test evidence, so it covers only part of the standard.

Why D is correct: A custom Microsoft Purview Compliance Manager assessment turns each procedural control into an improvement action with ownership, evidence, and a score, which satisfies the accountability half of the standard that configuration scanning cannot.

A water treatment operator must improve security across the boundary between its information technology and operational technology estates. Two endpoint problems are in scope: the programmable logic controllers and human-machine interfaces on the plant floor cannot accept any installed agent and must keep running uninterrupted, and the Windows engineering workstations that operators use to program those controllers are full endpoints that bridge from the corporate network into the control network. The architect must select the capabilities that protect each endpoint class correctly. Which two design choices fit these endpoint requirements? Select TWO.

• AInstall the Microsoft Defender for Endpoint sensor directly onto the programmable logic controllers and human-machine interfaces so the plant-floor devices gain the same behavioural detection and response as the engineering workstations.
• BEnable Microsoft Defender for Servers on the engineering workstations so the server workload protection plan delivers the threat detection and vulnerability assessment these bridging Windows hosts require across the boundary.
• CDeploy Microsoft Defender for IoT network sensors to passively discover and baseline the controllers and human-machine interfaces and alert on industrial-protocol anomalies, without installing any agent or interrupting plant operation.check_circle Correct
• DOnboard the Windows engineering workstations to Microsoft Defender for Endpoint so the bridging hosts gain behavioural detection, endpoint detection and response, and a unified incident view alongside the rest of the managed endpoint estate.check_circle Correct

Why A is wrong: Putting the endpoint sensor on the controllers seems to unify protection, but those devices cannot accept an installed agent and must not be disrupted, so this design is infeasible and risks interrupting the very plant operation the requirement protects.

Why B is wrong: Defender for Servers covers server virtual machines and is tempting because it does endpoint-style detection, but the engineering workstations are client endpoints rather than server workloads, so the server plan is the wrong tier of protection for them.

Why C is correct: Passive Defender for IoT network sensors are the correct fit for the unmanageable controllers and human-machine interfaces, because they inventory the devices and detect industrial-protocol anomalies from mirrored traffic without any agent or disruption to the running plant.

Why D is correct: The engineering workstations are full Windows endpoints that bridge into the control network, so Defender for Endpoint correctly gives them behavioural detection and endpoint detection and response, hardening the most likely pivot point into the operational technology estate.

An architect is designing internal network segmentation for a sensitive Azure workload under the Zero Trust assume-breach principle, so that a single compromised host cannot move freely east-west to other tiers. Autoscale constantly changes each host's private IP address, so the design must remain durable as instances are created and destroyed. Which two design properties should the segmentation exhibit to satisfy assume-breach durably? Select TWO.

• AExpress the allowed flows by the workload role a host plays using application security groups, so the rules survive instances being rebuilt with different private IP addresses.check_circle Correct
• BAdopt a default-deny posture between tiers so that only the explicitly required flows are permitted and every other east-west path is blocked by default.check_circle Correct
• CPermit all intra-virtual-network traffic by default and rely on host-based antivirus on each tier to detect and stop any lateral movement that occurs after a breach.
• DPin each segmentation rule to the current static private IP addresses of the tier and update the rule set manually whenever autoscale changes an instance address.

Why A is correct: Application security groups bind rules to a logical role rather than a fixed address, so the segmentation stays correct as autoscale replaces instances, which is exactly what a durable assume-breach design needs.

Why B is correct: Default-deny with explicit allow rules is the assume-breach control that limits lateral movement, because any flow not deliberately authorised is refused rather than implicitly trusted.

Why C is wrong: Leaving the network flat and trusting endpoint antivirus feels pragmatic, but it violates assume-breach by allowing free east-west movement and depends on a single detective control rather than preventing the path.

Why D is wrong: Address-based rules look precise, but they break the moment autoscale rebuilds an instance with a new address and the manual upkeep guarantees drift, so the segmentation cannot be trusted to hold.

An architect is upgrading a multicloud estate from the free foundational posture tier of Microsoft Defender for Cloud to the paid Defender Cloud Security Posture Management (Defender CSPM) plan. Leadership wants to know which advanced posture capabilities the upgrade unlocks beyond the free Secure Score and basic recommendations, so the design can justify the cost. Which two capabilities does enabling the Defender CSPM plan add for this purpose? Select TWO.

• AAttack path analysis that models how chained weaknesses across resources could be exploited to reach the estate's critical assets, so remediation can be prioritised on real exploitable paths rather than on a flat list of recommendations.check_circle Correct
• BAgentless scanning of virtual machines for vulnerabilities and discovered secrets, so software weaknesses and exposed credentials are assessed without deploying and maintaining a scanning agent on each host.check_circle Correct
• CReal-time runtime threat detection of malicious processes and reverse shells executing on the protected servers, so active in-progress attacks on the workloads raise alerts that feed the incident queue.
• DContinuous regulatory compliance scoring of the estate against external standards such as ISO 27001 and PCI DSS, so auditors can review a control-by-control dashboard that only the paid posture plan exposes.

Why A is correct: Attack path analysis is a Defender CSPM capability that correlates exposure data into ranked paths to critical assets, which is exactly the advanced prioritisation the free foundational tier does not provide.

Why B is correct: Agentless machine scanning for vulnerabilities and secrets is delivered by the Defender CSPM plan, giving posture coverage of host software and credentials that the free foundational tier does not include.

Why C is wrong: Runtime threat detection on servers is tempting because it is part of Defender for Cloud, but it is delivered by the workload protection plan Defender for Servers, not by the Defender CSPM posture plan the question is scoping.

Why D is wrong: Regulatory compliance is appealing as a posture feature, but the Microsoft cloud security benchmark compliance view is available in the free foundational tier, so it is not a capability the Defender CSPM upgrade unlocks.

A financial services organisation wants its backup design to survive a ransomware operator who has already gained Global Administrator rights in Microsoft Entra ID and intends to delete or encrypt all backups before detonating. Which backup design property most directly satisfies this resiliency requirement?

• ABackups are written to immutable, time-locked storage that no administrator role can delete or alter until the retention period expires.check_circle Correct
• BBackups are replicated to a second Azure region so that a regional outage cannot make the restore points unavailable.
• CBackups are encrypted at rest with customer-managed keys held in an Azure Key Vault that the backup service can read automatically.
• DBackups run more frequently so that the recovery point objective is reduced to under fifteen minutes for every protected workload.

Why A is correct: Immutability with a retention lock enforces the assume-breach principle so that even a fully compromised privileged identity cannot delete or encrypt the protected restore point, which is exactly what the requirement demands.

Why B is wrong: Geo-replication defends against a datacentre or regional failure and seems resilient, but a privileged attacker can issue deletion against replicated copies just as easily, so it does not counter a malicious insider-level identity.

Why C is wrong: Encryption at rest protects backup confidentiality and is tempting because it sounds like hardening, but it does nothing to stop a Global Administrator from deleting the backups outright, so it misses the stated threat.

Why D is wrong: A tighter recovery point objective improves data freshness and is appealing for resilience metrics, but more frequent copies in deletable storage are equally destroyable by the compromised admin, so the threat is unaddressed.

While designing a ransomware resiliency strategy, an architect is asked to identify the single highest-leverage protection to prioritise first according to Microsoft Security Best Practices, because most large-scale ransomware incidents pivot through one common control failure. Which priority should the design address first?

• ADeploying Microsoft Defender for Endpoint to every workstation and server so that malicious binaries are blocked at execution time.
• BSecuring privileged access by isolating administrative identities and enforcing just-in-time elevation through Microsoft Entra Privileged Identity Management.check_circle Correct
• CImplementing immutable backups so that encrypted production data can always be restored after a successful detonation.
• DEnabling Microsoft Sentinel analytics rules tuned to detect lateral movement and mass file-encryption behaviour across the estate.

Why A is wrong: Endpoint protection is essential and tempting as a first move, but it is a detection and prevention layer that attackers routinely evade, whereas removing standing privileged access denies the escalation the campaign relies on, so it is not the first priority.

Why B is correct: Microsoft guidance ranks protecting privileged access as the top ransomware priority because operators escalate to admin rights to spread payloads and destroy backups, so removing standing privilege closes the path the attack depends on.

Why C is wrong: Recoverable backups are a critical pillar and appealing because recovery is the visible outcome, but they assume the attack has already succeeded, so prioritising them before privileged access leaves the breach path open.

Why D is wrong: SIEM analytics improve detection speed and are attractive for visibility, but detection alerts after compromise has begun, so it does not prevent the privileged-access escalation that Microsoft ranks as the leading priority.

A manufacturer is designing recovery for a destructive attack that compromises Active Directory itself. The requirement is to be able to rebuild a trustworthy directory and core services even if the production forest and its domain controllers are fully encrypted. Which design element best meets this resiliency goal?

• AContinuous replication of all domain controllers to a secondary region using Azure Site Recovery for fast regional failover.
• BA read-only domain controller deployed in a branch site so that authentication continues if the primary domain controllers fail.
• CAn isolated recovery environment with offline, validated forest backups from which Active Directory can be rebuilt independently of the compromised production network.check_circle Correct
• DFrequent system state backups stored on a file share inside the production domain for quick local restore of each controller.

Why A is wrong: Site Recovery gives rapid failover and appears resilient, but it faithfully replicates the encrypted or tampered state of the directory, so failing over simply brings the compromised forest online elsewhere.

Why B is wrong: A read-only domain controller adds branch resilience and is tempting because it is another directory copy, but it replicates from the same compromised forest and would inherit the corruption, so it cannot serve as a trustworthy rebuild source.

Why C is correct: A clean-room recovery environment with offline directory backups lets the organisation restore a known-good forest without trusting any compromised production asset, which is precisely what recovery from a directory-wide destructive attack requires.

Why D is wrong: In-domain system state backups speed routine restores and seem convenient, but storing them inside the compromised production domain leaves them reachable by the attacker, so they cannot guarantee a clean rebuild.

A product group is about to start building a new customer-facing lending service and the security architect must embed the application security lifecycle so that design-level weaknesses are caught at the cheapest point to fix, before any code exists. Applying secure development lifecycle guidance and the Zero Trust verify-explicitly principle, which two practices belong at the design phase of this service rather than later in the pipeline? Select TWO.

• ARun a structured threat-modelling workshop over the proposed data-flow diagrams to enumerate spoofing, tampering, and elevation-of-privilege risks against each trust boundary before development begins.check_circle Correct
• BDefine the authentication and authorisation model up front so that every service-to-service call is planned to verify identity explicitly rather than trusting network position, and record those decisions as security requirements.check_circle Correct
• CConfigure dynamic application security testing to exercise the running, deployed service from the outside so that exploitable runtime flaws are discovered against a live endpoint.
• DStand up a web application firewall in front of the service with managed rule sets so that injection and cross-site scripting attempts are filtered at the network edge in production.

Why A is correct: Threat modelling over data-flow diagrams reasons about trust boundaries while the system is still a design, which is precisely the design-phase activity that surfaces authorisation and trust flaws before any code is written and they become expensive to remediate.

Why B is correct: Deciding the identity and least-privilege access model during design is a verify-explicitly requirement that shapes the architecture itself, so capturing it as a security requirement at this phase is exactly where the secure development lifecycle places it.

Why C is wrong: Dynamic testing is a genuine lifecycle control and is tempting because it finds real flaws, but it requires a deployed running application and therefore belongs to the verification phase, not the design phase the requirement asks about.

Why D is wrong: An edge firewall is a valuable production control and is tempting as a security measure, but it is an operational runtime defence added after deployment and does nothing to surface design-level flaws before code exists.

A media company lets external partners upload media files into an Azure Data Lake Storage Gen2 account that are later served to users, and it also runs several Azure SQL databases holding customer records. The architect must add built-in Microsoft Defender for Cloud plans that detect malware in the uploaded blobs and alert on anomalous storage access, and that scan the databases for misconfigurations and detect SQL injection and unusual data access, without building custom analytics. Which two plans should the design enable? Select TWO.

• AMicrosoft Defender for Storage, to scan uploaded blobs for malware on upload and alert on anomalous access patterns and suspicious operations against the storage account.check_circle Correct
• BMicrosoft Defender for Servers, to add endpoint detection and response and vulnerability assessment to the virtual machines that host the storage gateway and the database engine.
• CMicrosoft Defender for Databases, to run vulnerability assessment against the Azure SQL databases and alert on SQL injection and anomalous data-access activity.check_circle Correct
• DMicrosoft Sentinel analytics rules, to ingest the storage and database logs and write detections for malware uploads and suspicious SQL activity across both data stores.

Why A is correct: Microsoft Defender for Storage provides on-upload malware scanning and activity-anomaly alerting for storage accounts as a built-in plan, directly meeting the requirement to detect malware in uploaded blobs and flag anomalous storage access.

Why B is wrong: Microsoft Defender for Servers protects virtual machine workloads with endpoint detection and vulnerability assessment, which is tempting because servers underpin the services, but it does not scan blobs or databases as data services, so it leaves both stated data-protection needs unmet.

Why C is correct: Microsoft Defender for Databases includes vulnerability assessment and advanced threat protection for Azure SQL, detecting misconfigurations, SQL injection, and unusual data access as a built-in plan, which is exactly the database requirement.

Why D is wrong: Microsoft Sentinel could ingest the logs and raise alerts, which is tempting for unified detection, but authoring rules for these scenarios is custom engineering rather than a built-in plan, so it fails the requirement to avoid building custom analytics.

A product team is about to begin building a new customer-facing payments service and asks a security architect when, in the application lifecycle, design-level security flaws such as missing authorisation boundaries and unsafe trust assumptions should be identified. The architect wants the practice that surfaces these flaws before code is written, by reasoning about the system's data flows and trust boundaries. Which practice best meets this requirement?

• APerform threat modeling during the design phase, enumerating data flows and trust boundaries to identify and rank design weaknesses before any code exists.check_circle Correct
• BRun dynamic application security testing against a deployed staging build so that exploitable runtime weaknesses are discovered before the service reaches production traffic.
• CAdd static application security testing to the build pipeline so that insecure coding patterns are flagged automatically every time a developer commits source.
• DSchedule an external penetration test ahead of launch so that an independent team validates the service's defences against realistic attacker techniques first.

Why A is correct: Threat modeling is the design-phase activity that maps data flows and trust boundaries to expose architectural weaknesses such as missing authorisation, so it identifies and ranks design flaws exactly when the requirement demands, before implementation begins.

Why B is wrong: Dynamic testing is valuable and tempting because it finds real exploitable issues, but it runs against built, deployed code and so cannot surface the design-level trust-boundary flaws the requirement targets before code is written.

Why C is wrong: Static analysis catches insecure code patterns and feels like the earliest control, but it operates on committed source rather than the architecture, so it misses design flaws that exist before code and that no scanner reads from a diagram.

Why D is wrong: A penetration test gives independent assurance and is appealing as a gate, but it happens against a near-complete system late in the lifecycle, so it finds design flaws only after they are expensively built rather than before code is written.