Free SC-100 practice questions

A bank wants its session controls to react when a user's access is revoked or their token is flagged as risky mid-session, rather than waiting up to an hour for the existing access token to expire. The design must apply to Exchange Online and SharePoint Online access from Microsoft Entra ID. Which capability should the architect specify to meet this near-real-time enforcement requirement?

• AEnable continuous access evaluation so that supported services receive revocation and critical-event signals and reject the existing token within minutes of the change.check_circle Correct
• BTighten the Conditional Access sign-in frequency to a short interval so that users are forced to re-authenticate against the latest policy at frequent points during the day.
• CConfigure Microsoft Entra ID Protection risk policies so that a user flagged as high risk is blocked the next time they attempt to authenticate to a protected application.
• DShorten the configurable access token lifetime through a token lifetime policy so that issued tokens stop working far sooner than the default window allows.

Why A is correct: Continuous access evaluation establishes a near-real-time channel between Microsoft Entra ID and supported resources such as Exchange Online and SharePoint Online, so revocation or a risky-user event invalidates the live token almost immediately rather than at expiry.

Why B is wrong: Reducing sign-in frequency does reapply policy more often and feels responsive, but it still only acts at the next scheduled prompt rather than the moment of revocation, so it cannot deliver the near-real-time enforcement the requirement demands.

Why C is wrong: Risk policies score the identity and gate the next authentication, which is tempting because risk is involved, but they evaluate at sign-in and do not terminate an access token that has already been issued, so the active session continues.

Why D is wrong: A shorter token lifetime narrows the exposure window and looks like a direct fix, but it still leaves a fixed gap between revocation and expiry and Microsoft now steers customers to continuous evaluation instead, so it does not meet the requirement.

A professional services firm grants partner staff guest access to internal Microsoft Entra ID applications and finds that guest accounts accumulate long after projects end. The design must let business owners grant time-bound access through a self-service request and have that access recertified or removed automatically when it is no longer justified. Which design best satisfies this external-identity governance requirement?

• APlace every guest into Microsoft Entra Privileged Identity Management so that they must activate their access just in time and the activation expires after a fixed window each day.
• BUse Microsoft Entra entitlement management access packages with connected organisations and assignment expiry, combined with scheduled access reviews of the guests inside each package.check_circle Correct
• CApply a Conditional Access policy that requires guests to perform multi-factor authentication and to sign in only from a compliant device before reaching internal applications.
• DTighten the external collaboration settings so that invitations can be issued only by administrators and only for partner domains on an explicit allow list.

Why A is wrong: Privileged Identity Management gives just-in-time elevation and looks like lifecycle control, but it is built for privileged role and group activation rather than self-service partner onboarding and recurring recertification, so it does not fit broad guest access governance.

Why B is correct: Entitlement management lets business owners publish access packages that partners request for themselves, sets time-bound assignments that expire, and pairs with access reviews so unjustified guest access is recertified or revoked, which is exactly the lifecycle the requirement describes.

Why C is wrong: Requiring multi-factor authentication and device compliance strengthens how guests connect and is tempting as a control, but it only governs the act of signing in and never addresses who still holds access or when it should be removed, so the accumulation problem remains.

Why D is wrong: Restricting who may invite guests and to which domains controls the front door and seems like governance, but it does nothing to expire existing assignments or recertify standing guest access, so stale accounts still build up over time.

A government services portal must let citizens prove that they hold a verified qualification issued by an accredited body before they receive a benefit, but the agency wants to avoid becoming the custodian of the underlying identity documents and wants the citizen to control what is shared. Which Microsoft identity approach best meets this proofing requirement while minimising the personal data the agency stores?

• AOnboard each citizen as a Microsoft Entra B2B guest and store the scanned qualification documents against the guest object so caseworkers can verify them when a claim is made.
• BStand up a Microsoft Entra B2C tenant with custom policies that collect and retain the citizen's documents during sign-up so the proof is captured once at registration.
• CIssue the qualification as a Microsoft Entra Verified ID verifiable credential that the citizen holds in a wallet and presents to the portal, which validates it without storing the source documents.check_circle Correct
• DFederate the portal directly to the issuing body's identity provider so that every benefit claim triggers a live lookup of the citizen's qualification against that provider's records.

Why A is wrong: B2B guest onboarding is a familiar external-identity pattern, but it makes the agency hold the identity documents on the guest object, which increases the personal data it must protect and gives the citizen no control, so it works against the stated goal.

Why B is wrong: A B2C tenant handles consumer sign-up at scale and is tempting for citizen-facing portals, but retaining the source documents at registration still concentrates sensitive data in the agency and removes citizen control, so it misses the data-minimisation requirement.

Why C is correct: Microsoft Entra Verified ID lets the accredited body issue a verifiable credential that the citizen keeps and presents selectively, so the portal cryptographically validates the claim without the agency ever custodying the underlying documents, which is precisely the data-minimising, citizen-controlled model required.

Why D is wrong: Direct federation to the issuer gives an authoritative answer and seems efficient, but it forces a live dependency and real-time data exchange with the issuer on every claim and still does not put the citizen in control of disclosure, so it does not fit the design intent.

A security architect must remove a long-standing risk where every Windows server and workstation in a hybrid estate shares an identical, rarely rotated built-in local administrator password, giving an attacker who cracks one device lateral movement to all of them. The design must automatically randomise and rotate each device's local administrator password and store it so that only authorised staff can retrieve it. Which capability should the architect specify to meet this requirement?

• AWindows Local Administrator Password Solution, configured to automatically randomise and rotate each device's built-in local administrator password and store it in the directory so that only authorised staff can retrieve the current value.check_circle Correct
• BMicrosoft Entra Privileged Identity Management, configured to grant just-in-time, time-bound activation of the local administrator role on each Windows device so that standing local administrator credentials are eliminated across the estate.
• CMicrosoft Entra Conditional Access, configured with device-compliance policies so that the shared local administrator account cannot sign in from a device that fails its posture checks across the estate.
• DMicrosoft Defender for Endpoint, configured with attack surface reduction rules so that misuse of the shared local administrator account is blocked and rotated automatically across every onboarded Windows device.

Why A is correct: Windows LAPS is purpose-built to set a unique, automatically rotated local administrator password per device and back it up to Microsoft Entra ID or Active Directory with controlled retrieval, which directly removes the shared-password lateral movement risk.

Why B is wrong: Privileged Identity Management is tempting because it governs privileged role activation, but it brokers just-in-time access to directory and Azure roles rather than randomising and rotating the per-device built-in local administrator password that this requirement targets.

Why C is wrong: Conditional Access is appealing because it gates sign-in by device posture, but it evaluates access to cloud and federated resources rather than randomising or rotating the local administrator password stored on each Windows device itself.

Why D is wrong: Defender for Endpoint is tempting as the device protection plane, but it detects and reduces attack surface rather than managing or rotating local account passwords, so it does not satisfy the credential-rotation requirement.

A manufacturer runs a plant floor of programmable logic controllers and human-machine interfaces that cannot accept an installed agent and must not be rebooted for monitoring. The security architect needs a design that passively discovers these operational technology assets, builds a behavioural baseline of industrial protocols, and alerts on anomalies without disrupting production. Which Microsoft capability fits this operational technology monitoring requirement?

• AMicrosoft Defender for Servers, deployed through Microsoft Defender for Cloud to install endpoint sensors on the plant controllers so that industrial protocol anomalies are baselined and alerted without rebooting the devices.
• BMicrosoft Defender for IoT, deployed with passive network sensors that mirror plant traffic to discover operational technology assets, baseline industrial protocols, and alert on anomalies without touching the devices.check_circle Correct
• CMicrosoft Defender for Endpoint, onboarded to each programmable logic controller and human-machine interface so that the operational technology estate gains behavioural baselining of industrial protocols and anomaly alerts.
• DMicrosoft Defender for Cloud Apps, configured with session policies that inspect the plant control traffic so that operational technology protocol anomalies are baselined and alerted without an agent on the controllers.

Why A is wrong: Defender for Servers is tempting as the workload protection plane, but it protects Windows and Linux server operating systems with an installed sensor, which the agentless plant controllers in this scenario cannot host.

Why B is correct: Defender for IoT uses agentless passive network monitoring and deep packet inspection of industrial protocols to discover and baseline operational technology assets and flag anomalies, which exactly matches a non-intrusive plant-floor requirement.

Why C is wrong: Defender for Endpoint appeals because it is the core endpoint protection product, but it requires an onboarded operating system agent that embedded industrial controllers do not support, so it cannot passively monitor this operational technology.

Why D is wrong: Defender for Cloud Apps is tempting as an agentless inspection layer, but it is a cloud access security broker for SaaS and web app sessions, not a sensor that understands industrial control protocols on a plant network.

An organisation is onboarding hundreds of new Windows and Linux servers and wants every server to be hardened against a single, authoritative set of security controls that maps to recognised industry standards and feeds the secure score, rather than against each team's hand-written configuration. Which design choice gives the architect that standards-mapped server hardening baseline?

• AAdopt the Cloud Adoption Framework for Azure as the server hardening baseline, applying its landing zone guidance as the authoritative control set and assessing compliance through Microsoft Defender for Cloud secure score.
• BAdopt the Azure Well-Architected Framework as the server hardening baseline, applying its security pillar as the authoritative control set and assessing compliance through Microsoft Defender for Cloud secure score.
• CAdopt the Microsoft cloud security benchmark as the server hardening baseline, applying its standards-mapped operating system and compute controls and assessing compliance through Microsoft Defender for Cloud secure score.check_circle Correct
• DAdopt the enterprise access model as the server hardening baseline, applying its privileged tier definitions as the authoritative control set and assessing compliance through Microsoft Defender for Cloud secure score.

Why A is wrong: The Cloud Adoption Framework is tempting because it shapes secure cloud foundations, but it provides governance and landing zone guidance rather than the prescriptive, standards-mapped server control set that drives secure score assessment.

Why B is wrong: The Well-Architected Framework appeals because its security pillar informs design quality, but it offers architectural trade-off principles rather than the prescriptive, control-mapped server hardening baseline that the benchmark provides.

Why C is correct: The Microsoft cloud security benchmark supplies prescriptive, industry-standards-mapped controls including server operating system hardening and is the default initiative behind Defender for Cloud secure score, which is precisely the authoritative baseline the requirement describes.

Why D is wrong: The enterprise access model is tempting as a structured control framework, but it defines privileged access tiers for administration rather than supplying the standards-mapped operating system hardening controls this requirement needs.

A financial services organisation wants its backup design to survive a ransomware operator who has already gained Global Administrator rights in Microsoft Entra ID and intends to delete or encrypt all backups before detonating. Which backup design property most directly satisfies this resiliency requirement?

• ABackups are written to immutable, time-locked storage that no administrator role can delete or alter until the retention period expires.check_circle Correct
• BBackups are replicated to a second Azure region so that a regional outage cannot make the restore points unavailable.
• CBackups are encrypted at rest with customer-managed keys held in an Azure Key Vault that the backup service can read automatically.
• DBackups run more frequently so that the recovery point objective is reduced to under fifteen minutes for every protected workload.

Why A is correct: Immutability with a retention lock enforces the assume-breach principle so that even a fully compromised privileged identity cannot delete or encrypt the protected restore point, which is exactly what the requirement demands.

Why B is wrong: Geo-replication defends against a datacentre or regional failure and seems resilient, but a privileged attacker can issue deletion against replicated copies just as easily, so it does not counter a malicious insider-level identity.

Why C is wrong: Encryption at rest protects backup confidentiality and is tempting because it sounds like hardening, but it does nothing to stop a Global Administrator from deleting the backups outright, so it misses the stated threat.

Why D is wrong: A tighter recovery point objective improves data freshness and is appealing for resilience metrics, but more frequent copies in deletable storage are equally destroyable by the compromised admin, so the threat is unaddressed.

While designing a ransomware resiliency strategy, an architect is asked to identify the single highest-leverage protection to prioritise first according to Microsoft Security Best Practices, because most large-scale ransomware incidents pivot through one common control failure. Which priority should the design address first?

• ADeploying Microsoft Defender for Endpoint to every workstation and server so that malicious binaries are blocked at execution time.
• BSecuring privileged access by isolating administrative identities and enforcing just-in-time elevation through Microsoft Entra Privileged Identity Management.check_circle Correct
• CImplementing immutable backups so that encrypted production data can always be restored after a successful detonation.
• DEnabling Microsoft Sentinel analytics rules tuned to detect lateral movement and mass file-encryption behaviour across the estate.

Why A is wrong: Endpoint protection is essential and tempting as a first move, but it is a detection and prevention layer that attackers routinely evade, whereas removing standing privileged access denies the escalation the campaign relies on, so it is not the first priority.

Why B is correct: Microsoft guidance ranks protecting privileged access as the top ransomware priority because operators escalate to admin rights to spread payloads and destroy backups, so removing standing privilege closes the path the attack depends on.

Why C is wrong: Recoverable backups are a critical pillar and appealing because recovery is the visible outcome, but they assume the attack has already succeeded, so prioritising them before privileged access leaves the breach path open.

Why D is wrong: SIEM analytics improve detection speed and are attractive for visibility, but detection alerts after compromise has begun, so it does not prevent the privileged-access escalation that Microsoft ranks as the leading priority.

A manufacturer is designing recovery for a destructive attack that compromises Active Directory itself. The requirement is to be able to rebuild a trustworthy directory and core services even if the production forest and its domain controllers are fully encrypted. Which design element best meets this resiliency goal?

• AContinuous replication of all domain controllers to a secondary region using Azure Site Recovery for fast regional failover.
• BA read-only domain controller deployed in a branch site so that authentication continues if the primary domain controllers fail.
• CAn isolated recovery environment with offline, validated forest backups from which Active Directory can be rebuilt independently of the compromised production network.check_circle Correct
• DFrequent system state backups stored on a file share inside the production domain for quick local restore of each controller.

Why A is wrong: Site Recovery gives rapid failover and appears resilient, but it faithfully replicates the encrypted or tampered state of the directory, so failing over simply brings the compromised forest online elsewhere.

Why B is wrong: A read-only domain controller adds branch resilience and is tempting because it is another directory copy, but it replicates from the same compromised forest and would inherit the corruption, so it cannot serve as a trustworthy rebuild source.

Why C is correct: A clean-room recovery environment with offline directory backups lets the organisation restore a known-good forest without trusting any compromised production asset, which is precisely what recovery from a directory-wide destructive attack requires.

Why D is wrong: In-domain system state backups speed routine restores and seem convenient, but storing them inside the compromised production domain leaves them reachable by the attacker, so they cannot guarantee a clean rebuild.

A product team is about to begin building a new customer-facing payments service and asks a security architect when, in the application lifecycle, design-level security flaws such as missing authorisation boundaries and unsafe trust assumptions should be identified. The architect wants the practice that surfaces these flaws before code is written, by reasoning about the system's data flows and trust boundaries. Which practice best meets this requirement?

• APerform threat modeling during the design phase, enumerating data flows and trust boundaries to identify and rank design weaknesses before any code exists.check_circle Correct
• BRun dynamic application security testing against a deployed staging build so that exploitable runtime weaknesses are discovered before the service reaches production traffic.
• CAdd static application security testing to the build pipeline so that insecure coding patterns are flagged automatically every time a developer commits source.
• DSchedule an external penetration test ahead of launch so that an independent team validates the service's defences against realistic attacker techniques first.

Why A is correct: Threat modeling is the design-phase activity that maps data flows and trust boundaries to expose architectural weaknesses such as missing authorisation, so it identifies and ranks design flaws exactly when the requirement demands, before implementation begins.

Why B is wrong: Dynamic testing is valuable and tempting because it finds real exploitable issues, but it runs against built, deployed code and so cannot surface the design-level trust-boundary flaws the requirement targets before code is written.

Why C is wrong: Static analysis catches insecure code patterns and feels like the earliest control, but it operates on committed source rather than the architecture, so it misses design flaws that exist before code and that no scanner reads from a diagram.

Why D is wrong: A penetration test gives independent assurance and is appealing as a gate, but it happens against a near-complete system late in the lifecycle, so it finds design flaws only after they are expensively built rather than before code is written.

A product group is about to start building a new customer-facing lending service and the security architect must embed the application security lifecycle so that design-level weaknesses are caught at the cheapest point to fix, before any code exists. Applying secure development lifecycle guidance and the Zero Trust verify-explicitly principle, which two practices belong at the design phase of this service rather than later in the pipeline? Select TWO.

• ARun a structured threat-modelling workshop over the proposed data-flow diagrams to enumerate spoofing, tampering, and elevation-of-privilege risks against each trust boundary before development begins.check_circle Correct
• BDefine the authentication and authorisation model up front so that every service-to-service call is planned to verify identity explicitly rather than trusting network position, and record those decisions as security requirements.check_circle Correct
• CConfigure dynamic application security testing to exercise the running, deployed service from the outside so that exploitable runtime flaws are discovered against a live endpoint.
• DStand up a web application firewall in front of the service with managed rule sets so that injection and cross-site scripting attempts are filtered at the network edge in production.

Why A is correct: Threat modelling over data-flow diagrams reasons about trust boundaries while the system is still a design, which is precisely the design-phase activity that surfaces authorisation and trust flaws before any code is written and they become expensive to remediate.

Why B is correct: Deciding the identity and least-privilege access model during design is a verify-explicitly requirement that shapes the architecture itself, so capturing it as a security requirement at this phase is exactly where the secure development lifecycle places it.

Why C is wrong: Dynamic testing is a genuine lifecycle control and is tempting because it finds real flaws, but it requires a deployed running application and therefore belongs to the verification phase, not the design phase the requirement asks about.

Why D is wrong: An edge firewall is a valuable production control and is tempting as a security measure, but it is an operational runtime defence added after deployment and does nothing to surface design-level flaws before code exists.

An architect is designing how an Azure-hosted web application will authenticate to Azure SQL Database and Azure Key Vault. The design goal is to eliminate any long-lived credential that a developer must store, rotate, or could accidentally commit, while still giving the application a strong identity inside Microsoft Entra ID. Which approach best satisfies this requirement?

• ARegister an application and use a client secret stored in the app's configuration, rotating the secret on a defined schedule so that exposure windows stay short.
• BAssign a system-assigned managed identity to the application so that Microsoft Entra ID issues and rotates its credential automatically and the platform retrieves tokens on its behalf.check_circle Correct
• CGenerate a certificate-based service principal and place the private key in the application package so that the credential is bound to the running deployment artefact.
• DConfigure SQL authentication and a Key Vault access policy keyed to a shared application username and password held in an encrypted configuration store.

Why A is wrong: A registered app with a rotated client secret is a familiar pattern and feels safe with short rotation, but it still introduces a long-lived credential the team must store and protect, which is precisely the exposure the requirement aims to remove.

Why B is correct: A system-assigned managed identity gives the app a Microsoft Entra identity whose credential the platform creates and rotates automatically, so no developer ever stores or rotates a secret, which is exactly the credential-free design the requirement demands.

Why C is wrong: A certificate credential is stronger than a password and is tempting for that reason, but shipping the private key inside the package still creates a secret the team must protect and rotate, leaving the storable-credential problem unsolved.

Why D is wrong: An encrypted store for a shared username and password sounds protective and is a common reflex, but it still relies on a long-lived secret the application must read and someone must rotate, so it fails the requirement to eliminate storable credentials.