Sign in

Free SC-100 sample questions

Real questions from the Cybersecurity Architect practice bank, with the correct answer and an explanation for each one. No junk, no filler.

Try them in the simulator Same questions, with study, timed and flashcard modes.

Showing 10 of 20 free sample questions.

Question 1Choose 2

An e-commerce company is building a new application on Azure Kubernetes Service (AKS). As part of their DevSecOps pipeline, they need to ensure that only approved and vulnerability-scanned container images are deployed to their production AKS cluster. The security policy dictates that any attempt to deploy an image that has not passed a security scan or is from an untrusted registry must be blocked. Which combination of Azure services should be used to enforce this policy? (Select TWO)

Question 2Choose 2

A healthcare organization uses Azure to store patient records in Azure SQL Database and Azure Blob Storage. They need to design a security solution that meets the following requirements: - Discover and classify sensitive patient data across all Azure data stores. - Provide a unified view of data security posture and identify potential threats to the data. - Detect anomalous activities, such as unusual data access or potential SQL injection attacks, against the data stores. Which two Microsoft Defender plans should be central to this design? (Select TWO)

Question 3Choose one

A manufacturing company, Aperture Dynamics, is implementing Microsoft Sentinel as its SIEM. They have a hybrid environment with on-premises servers, Azure VMs, and several Microsoft 365 services. The security operations team needs to automate the initial triage and response to common alerts, such as impossible travel alerts from Azure AD Identity Protection. The automation must post a message in a specific Microsoft Teams channel for the on-duty analyst, temporarily disable the user account, and create a high-priority ticket in ServiceNow. Which Microsoft Sentinel feature should be used to build this automated workflow?

Question 4Choose one

Stellaron Corp is designing a network security architecture for their Azure environment. They want to inspect all outbound internet traffic from their virtual networks to prevent data exfiltration and enforce corporate web policies. Additionally, they need to inspect traffic between spoke virtual networks that are peered to a central hub VNet. The solution must be a managed, cloud-native service that offers advanced threat protection, including TLS inspection and intrusion detection and prevention systems (IDPS). Which Azure service should be deployed in the hub VNet to meet all these requirements?

Question 5Choose one

True or False: When designing a resiliency strategy against ransomware, the primary focus should be on implementing advanced threat detection tools like EDR, with backup and recovery solutions being a secondary consideration.

Question 6Choose one

A university needs to provide secure access to on-premises legacy web applications for its researchers, who often work remotely. The university wants to avoid using a traditional VPN and instead adopt a Zero Trust approach. The solution must integrate with their existing Azure Active Directory for authentication, enforce Conditional Access policies like requiring MFA, and not require opening inbound ports on their on-premises firewall. Which service should the university's security architect recommend?

Question 7Choose one

A retail company is expanding its use of Microsoft 365 and is concerned about data leakage through both managed and unmanaged devices. A security architect must design a solution that provides visibility into cloud app usage, including discovering 'shadow IT' applications. The solution must also enforce granular session controls for sanctioned apps, such as blocking downloads of sensitive files to unmanaged devices. Which Microsoft 365 security service is the primary tool for achieving these Cloud Access Security Broker (CASB) functionalities?

Question 8Choose one

You are designing a security architecture for a new Azure environment. To align with the Microsoft Cloud Adoption Framework (CAF), you must ensure that all newly deployed resources automatically adhere to corporate security standards, such as enforcing specific NSG rules, enabling encryption, and restricting public IP addresses. What is the most effective way to implement this governance and security requirement at scale for all new subscriptions and resource groups?

Question 9Choose one

An organization is evaluating its threat detection coverage. The CISO wants to ensure that the security monitoring capabilities in Microsoft Sentinel effectively cover the tactics and techniques used by adversaries in cloud environments. The security architect needs to map the active analytic rules in Sentinel to a standardized framework to identify gaps in detection. Which framework is natively integrated into Microsoft Sentinel for this purpose?

Question 10Choose one

A multinational corporation has a complex hybrid identity setup using Azure AD Connect to synchronize its on-premises Active Directory with Azure AD. They are concerned about legacy authentication protocols (like POP3, IMAP, SMTP) being used to bypass modern security controls such as MFA. The security architect must recommend a policy to block these weak protocols for all users. What is the most direct and effective method to achieve this in Azure AD?

10 more free samples are waiting

Create a free account to unlock the whole SC-100 sample bank, or get full access to all 169 practice questions in the simulator.

Create account