90 free Microsoft SC-100 practice questions from the CertStash pack of 360, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 90 free here, all 360 in the pack, and each step includes the one before it.
Get all 360 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
Your company has a Microsoft 365 ES subscription. The Chief Compliance Officer plans to enhance privacy management in the working environment. You need to recommend a solution to enhance the privacy management. The solution must meet the following requirements: • Identify unused personal data and empower users to make smart data handling decisions. • Provide users with notifications and guidance when a user sends personal data in Microsoft Teams. • Provide users with recommendations to mitigate privacy risks. What should you include in the recommendation?
Show answer and explanation
Correct answer: C. Privacy Risk Management in Microsoft Priva
Microsoft Priva's Privacy Risk Management feature is specifically designed to identify unused personal data, provide users with notifications and guidance when personal data is shared in Teams, and offer recommendations to mitigate privacy risks. This directly addresses all three requirements mentioned in the question.
Why the other options are wrong
- A. Communication compliance focuses on detecting policy violations and inappropriate communications, not privacy data handling decisions.
- B. Microsoft Viva Insights provides workplace analytics and wellbeing insights, not privacy risk management capabilities.
- D. Advanced eDiscovery is for legal discovery and compliance investigations, not for identifying unused personal data or real-time guidance.
Question 2
You have an Azure subscription that has Microsoft Defender for Cloud enabled. Suspicious authentication activity alerts have been appearing in the Workload protections dashboard. You need to recommend a solution to evaluate and remediate the alerts by using workflow automation. The solution must minimize development effort. What should you include in the recommendation?
Show answer and explanation
Correct answer: D. Azure Logics Apps
Azure Logic Apps provide a low-code, no-code solution for workflow automation that can integrate with Microsoft Defender for Cloud to evaluate and remediate alerts. Logic Apps minimize development effort compared to other options and support complex conditional logic for alert response automation.
Why the other options are wrong
- A. Azure Monitor webhooks are for notifications only and do not provide workflow automation capabilities for evaluation and remediation.
- B. Azure Event Hubs is a data streaming platform for ingesting events, not for automation and remediation workflows.
- C. Azure Functions requires more development effort than Logic Apps and is code-based rather than low-code/no-code.
Question 3
Your company is moving a big data solution to Azure. The company plans to use the following storage workloads: • Azure Storage blob containers • Azure Data Lake Storage Gen2 Azure Storage file shares - • Azure Disk Storage Which two storage workloads support authentication by using Azure Active Directory (Azure AD)? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: C, D. Azure Storage blob containers; Azure Data Lake Storage Gen2
Azure Storage blob containers and Azure Data Lake Storage Gen2 both support Azure AD authentication. Azure Blob Storage supports Azure AD authentication for data plane operations, and Data Lake Storage Gen2 (which is built on Blob Storage) inherits this capability. These allow for granular access control and identity-based authentication.
Why the other options are wrong
- A. Azure Storage file shares support Azure AD authentication only for SMB protocol over domain-joined scenarios, not as a primary authentication method.
- B. Azure Disk Storage does not support Azure AD authentication; it relies on storage account keys or managed identities through the storage account layer.
Question 4
You have a Microsoft 365 E5 subscription and an Azure subscription. You are designing a Microsoft deployment. You need to recommend a solution for the security operations team. The solution must include custom views and a dashboard for analyzing security events. What should you recommend using in Microsoft Sentinel?
Show answer and explanation
Correct answer: C. workbooks
Microsoft Sentinel workbooks provide customizable dashboards and visualizations for analyzing security events. Workbooks allow security teams to create custom views, display KPIs, and present data in an organized manner tailored to their operational needs.
Why the other options are wrong
- A. Notebooks are for interactive investigation and data analysis using KQL, not for building dashboards.
- B. Playbooks are for automation and response actions, not for analyzing security events through dashboards.
- D. Threat intelligence provides threat data and indicators, not custom dashboards for event analysis.
Question 5
Your company has a Microsoft 365 subscription and uses Microsoft Defender for Identity. You are informed about incidents that relate to compromised identities. You need to recommend a solution to expose several accounts for attackers to exploit. When the attackers attempt to exploit the accounts, an alert must be triggered. Which Defender for Identity feature should you include in the recommendation?
Show answer and explanation
Correct answer: D. honeytoken entity tags
Honeytoken entity tags in Microsoft Defender for Identity create decoy accounts and credentials that appear legitimate but are monitored. When attackers attempt to exploit these honeytokens, alerts are automatically triggered, allowing security teams to detect and respond to compromised identity attacks.
Why the other options are wrong
- A. Sensitivity labels are for data classification and protection, not for creating decoy accounts to catch attackers.
- B. Custom user tags are for organizing and categorizing users, not for creating monitored decoy accounts.
- C. Standalone sensors are deployment components for Defender for Identity, not for creating honeypots or monitoring fake accounts.
Question 6
Your company is moving all on-premises workloads to Azure and Microsoft 365. You need to design a security orchestration, automation, and response (SOAR) strategy in Microsoft Sentinel that meets the following requirements: • Minimizes manual intervention by security operation analysts • Supports triaging alerts within Microsoft Teams channels What should you include in the strategy?
Show answer and explanation
Correct answer: B. playbooks
Playbooks are Microsoft Sentinel's SOAR automation feature that minimizes manual intervention by automating response actions. Playbooks can be triggered by alerts and integrated with Microsoft Teams channels to enable triage and response workflows directly within Teams.
Why the other options are wrong
- A. KQL is a query language for data analysis, not a SOAR automation mechanism.
- C. Data connectors ingest data into Sentinel but do not provide automation or response capabilities.
- D. Workbooks are for visualization and analysis, not for automating security responses or Teams integration.
Question 7
You have an Azure subscription that contains virtual machines, storage accounts, and Azure SQL databases. All resources are backed up multiple times a day by using Azure Backup. You are developing a strategy to protect against ransomware attacks. You need to recommend which controls must be enabled to ensure that Azure Backup can be used to restore the resources in the event of a successful ransomware attack. Which two controls should you include in the recommendation? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, B. Enable soft delete for backups; Require PINs for critical operations.
Soft delete for backups prevents accidental or malicious deletion of backup data by recovering deleted backups within a retention period, which is critical for ransomware recovery. Requiring PINs for critical operations adds an additional security layer to prevent unauthorized deletion or modification of backup configurations that attackers might attempt during a ransomware attack.
Why the other options are wrong
- C. While encryption with CMKs is valuable for security, it does not specifically prevent ransomware from destroying backup data or restore points.
- D. Offline backups to Azure Data Box are a good practice but are not real-time controls that prevent ransomware during an active attack.
- E. Monitoring notifications after configuration changes are helpful for awareness but do not prevent ransomware attacks or ensure recovery capability.
Question 8
Your company has a third-party security information and event management (SIEM) solution that uses Splunk and Microsoft Sentinel. You plan to integrate Microsoft Sentinel with Splunk. You need to recommend a solution to send security events from Microsoft Sentinel to Splunk. What should you include in the recommendation?
Show answer and explanation
Correct answer: B. Azure Event Hubs
Azure Event Hubs is the recommended solution for exporting security events from Microsoft Sentinel to third-party SIEM solutions like Splunk. Event Hubs provides a scalable, reliable streaming platform that can receive and forward data from Sentinel to external systems using connectors and integrations.
Why the other options are wrong
- A. Microsoft Sentinel data connectors are for ingesting data into Sentinel, not for exporting data to external systems.
- C. Workbooks are for visualization and analysis within Sentinel, not for exporting data to external SIEM solutions.
- D. Azure Data Factory is for data integration and ETL processes but is not the standard solution for Sentinel-to-Splunk integration.
Question 9
A customer follows the Zero Trust model and explicitly verifies each attempt to access its corporate applications. The customer discovers that several endpoints are infected with malware. The customer suspends access attempts from the infected endpoints. The malware is removed from the endpoints. Which two conditions must be met before endpoint users can access the corporate applications again? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: B, D. Microsoft Intune reports the endpoints as compliant; Microsoft Defender for Endpoint reports the endpoints as compliant.
In a Zero Trust model with explicit verification for each access attempt, after malware removal, the system must verify endpoint health through multiple compliance checks. Microsoft Defender for Endpoint is the primary security compliance tool that validates the endpoint is clean and secure post-remediation. Microsoft Intune provides device compliance management and works alongside Defender to ensure endpoints meet security policies before granting access. These two sources of truth ensure the endpoints are both malware-free and compliant with corporate security standards.
Why the other options are wrong
- A. Token refresh alone doesn't verify endpoint health; it's just a credential mechanism and wouldn't confirm malware removal.
- C. A new Conditional Access policy wouldn't be required; existing policies would evaluate the compliance status of already-compliant endpoints.
Question 10
You have a customer that has a Microsoft 365 subscription and uses the Free edition of Azure Active Directory (Azure AD). The customer plans to obtain an Azure subscription and provision several Azure resources. You need to evaluate the customer's security environment. What will necessitate an upgrade from the Azure AD Free edition to the Premium edition?
Show answer and explanation
Correct answer: A. Azure AD Privileged Identity Management (PIM)
Azure AD Privileged Identity Management (PIM) is an Azure AD Premium feature that enables just-in-time privileged access and role activation workflows. This is essential for managing admin access to Azure resources and adhering to Zero Trust principles. The Free edition does not include PIM capabilities, making this upgrade necessary for proper privileged identity management in Azure deployments.
Why the other options are wrong
- B. Role-based authorization (RBAC) is available in Azure AD Free edition.
- C. Resource-based authorization is a general authorization concept available in the Free tier.
- D. Azure AD Multi-Factor Authentication is available in Azure AD Free edition.
What people say about the full SC-100 pack 5.0 from 8
Question 11
You have a Microsoft 365 E5 subscription and an Azure subscription. You need to recommend a solution to enforce the Zero Trust principle of explicit verification for the subscriptions. The solution must be based on Zero Trust guidance in the Microsoft Cybersecurity Reference Architectures (MCRA). What should you include in the recommendation?
Show answer and explanation
Correct answer: A. Conditional Access
Conditional Access is the primary mechanism for implementing the Zero Trust principle of explicit verification in Microsoft Cybersecurity Reference Architectures. It requires continuous verification of user identity, device compliance, and risk assessment before granting access to resources, embodying the verify explicitly pillar of Zero Trust.
Why the other options are wrong
- B. Microsoft Defender for Identity focuses on threat detection in AD environments, not on enforcing explicit verification policies.
- C. Microsoft Defender for Cloud provides compliance monitoring and threat protection but is not the primary explicit verification mechanism.
- D. Microsoft Entra ID Identity Governance manages access lifecycle and entitlements but does not enforce explicit verification at access time like Conditional Access does.
Question 12
You have a multicloud environment that contains Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP) subscriptions. You need to discover and review role assignments across the subscriptions. What should you use?
Show answer and explanation
Correct answer: D. Microsoft Entra Permissions Management
Microsoft Entra Permissions Management is specifically designed to discover and manage role assignments and permissions across multiple cloud environments including Azure, AWS, and GCP. It provides visibility into permissions across multicloud subscriptions and identifies security risks associated with excessive privileges.
Why the other options are wrong
- A. Azure Lighthouse is for delegated management of Azure resources across subscriptions but does not provide multicloud role discovery for AWS and GCP.
- B. Microsoft Defender for Identity focuses on on-premises Active Directory threat detection, not multicloud permission and role assignment discovery.
- C. Microsoft Entra ID Governance manages identity governance and access reviews for Azure AD/Entra, not for discovering role assignments across multicloud environments.
Question 13
Your company has devices that run either Windows 10, Windows 11, or Windows Server. You are in the process of improving the security posture of the devices. You plan to use security baselines from the Microsoft Security Compliance Toolkit. What should you recommend using to compare the baselines to the current device configurations?
Show answer and explanation
Correct answer: D. Policy Analyzer
Policy Analyzer is the tool from the Microsoft Security Compliance Toolkit specifically designed to compare security baselines against current device configurations. It analyzes how current Group Policy and security settings compare to the recommended baselines, allowing organizations to identify gaps and deviations.
Why the other options are wrong
- A. Microsoft Intune is for device management and mobile device administration, not for comparing local policy baselines.
- B. Local Group Policy Object (LGPO) is a tool for applying policies, not for comparing baselines to current configurations.
- C. Windows Autopilot is used for device provisioning and enrollment, not for security baseline comparison.
Question 14
For an Azure deployment, you are designing a security architecture based on the Microsoft Cloud Security Benchmark. You need to recommend a best practice for implementing service accounts for Azure API management. What should you include in the recommendation?
Show answer and explanation
Correct answer: B. managed identities in Azure
Managed identities in Azure are the recommended best practice for API Management service accounts according to Microsoft Cloud Security Benchmark. Managed identities eliminate the need to store credentials, provide automatic credential rotation, and are integrated directly into Azure services. This approach eliminates credential exposure risks and simplifies lifecycle management for service accounts.
Why the other options are wrong
- A. Application registrations require credential management and are less secure than managed identities for service accounts.
- C. Service principals with usernames and passwords require storing and rotating credentials manually, creating security vulnerabilities.
- D. Device registrations are for device management, not for authenticating services.
- E. Service principals with certificate credentials, while better than passwords, are less ideal than managed identities which require no credential handling.
Question 15
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are designing the encryption standards for data at rest for an Azure resource. You need to provide recommendations to ensure that the data at rest is encrypted by using AES-256 keys. The solution must support rotating the encryption keys monthly. Solution: For blob containers in Azure Storage, you recommend encryption that uses customer-managed keys (CMKs). Does this meet the goal?
Show answer and explanation
Correct answer: A. Yes
Customer-managed keys (CMKs) for blob container encryption fully meet the goal because they enable AES-256 encryption for data at rest while providing complete control over key rotation policies. With CMKs stored in Azure Key Vault, you can implement automated monthly key rotation through Key Vault's rotation policies or perform manual rotation as needed, giving you the flexibility to meet the monthly rotation requirement.
Why the other options are wrong
- B. This is incorrect; CMKs are precisely the solution that meets both requirements of AES-256 encryption and monthly key rotation capability.
Question 16
You have the following on-premises servers that run Windows Server: • Two domain controllers in an Active Directory Domain Services (AD DS) domain • Two application servers named Server1 and Server2 that run ASP.NET web apps • A VPN server named Served that authenticates by using RADIUS and AD DS End users use a VPN to access the web apps over the internet. You need to redesign a user access solution to increase the security of the connections to the web apps. The solution must minimize the attack surface and follow the Zero Trust principles of the Microsoft Cybersecurity Reference Architectures (MCRA). What should you include in the recommendation?
Show answer and explanation
Correct answer: A. Publish the web apps by using Azure AD Application Proxy.
Azure AD Application Proxy is the Zero Trust solution that directly addresses secure web app access following MCRA principles. It eliminates the need for VPN and RADIUS authentication by providing conditional access verification, device compliance checks, and direct application-level access control without exposing infrastructure to the internet. This minimizes attack surface by removing the VPN gateway as an attack vector.
Why the other options are wrong
- B. While Azure AD authentication is beneficial, configuring it on the existing VPN still relies on VPN infrastructure and does not fully implement Zero Trust principles.
- C. Microsoft Defender for Cloud Apps provides visibility and control but is not the primary architectural solution for replacing VPN access.
- D. Microsoft Defender for Endpoint focuses on endpoint security and does not address the redesign of remote access infrastructure.
Question 17
Your company finalizes the adoption of Azure and is implementing Microsoft Defender for Cloud. You receive the following recommendations in Defender for Cloud • Access to storage accounts with firewall and virtual network configurations should be restricted. • Storage accounts should restrict network access using virtual network rules. • Storage account should use a private link connection. • Storage account public access should be disallowed. You need to recommend a service to mitigate identified risks that relate to the recommendations. What should you recommend?
Show answer and explanation
Correct answer: A. Azure Policy
Azure Policy is the appropriate service to mitigate the identified risks. It can enforce network restrictions, firewall rules, private link connections, and public access denial on storage accounts organization-wide. Policy can automatically remediate noncompliant storage accounts or deny their creation, directly addressing all four recommendations.
Why the other options are wrong
- B. Azure Network Watcher monitors network traffic but does not enforce policies or remediate storage account configurations.
- C. Azure Storage Analytics provides monitoring and logging data but does not enforce compliance policies or configurations.
- D. Microsoft Sentinel is a SIEM solution for threat detection and response, not for enforcing security configuration policies on storage accounts.
Question 18
You have an Azure Kubernetes Service (AKS) cluster that hosts Linux nodes. You need to recommend a solution to ensure that deployed worker nodes have the latest kernel updates. The solution must minimize administrative effort. What should you recommend?
Show answer and explanation
Correct answer: B. The updates must first be applied to the image used to provision the nodes.
Applying updates to the node image used for provisioning is the Microsoft recommended approach that minimizes administrative effort. AKS node images are regularly updated by Microsoft with the latest kernel patches, and new nodes created from updated images automatically receive these updates. This approach avoids manual patching and aligns with container best practices of immutable infrastructure.
Why the other options are wrong
- A. While node restarts may occur during updates, this describes a consequence rather than a solution strategy and doesn't address the process for ensuring latest updates.
- C. Upgrading the AKS cluster version updates Kubernetes but does not guarantee the latest kernel updates on Linux nodes; these are separate concerns.
Question 19
You are designing a ransomware mitigation strategy. You perform a ransomware risk assessment and identify business-critical assets. You need to recommend a solution to mitigate ransomware threats. The solution must follow Microsoft security best practices. Which two actions should you include in the recommendation? Each correct answer presents a complete solution. NOTE: Each correct answer is worth one point.
Show answer and explanation
Correct answer: C, D. Implement immutable, offline backups that have restricted access and test restore procedures regularly; Deploy Privileged Identity Management (PIM) that uses just-in-time (JIT) access and approval workflows.
Option C addresses the critical backup strategy: immutable, offline backups with restricted access and tested restore procedures are essential for ransomware recovery and align with zero-trust principles. Option D implements privileged access controls through PIM with JIT access and approval workflows, ensuring that critical operations require justified, time-limited access. Together, these provide defense-in-depth against ransomware by ensuring data recoverability and controlling privileged access that could be exploited by attackers.
Why the other options are wrong
- A. Firewall logging without traffic restrictions provides visibility but offers no actual mitigation against ransomware threats and does not follow security best practices for active defense.
- B. Extended patching cycles increase vulnerability windows and contradict Microsoft security best practices; accelerated patching reduces ransomware attack surface.
Question 20
Your company has a hybrid cloud infrastructure. The company plans to hire several temporary employees within a brief period. The temporary employees will need to access applications and data on the company's on-premises network. The company's secutity policy prevents the use of personal devices for accessing company data and applications. You need to recommend a solution to provide the temporary employee with access to company resources. The solution must be able to scale on demand. What should you include in the recommendation?
Show answer and explanation
Correct answer: A. Deploy Azure Virtual Desktop, Azure Active Directory (Azure AD) Conditional Access, and Microsoft Defender for Cloud Apps.
Azure Virtual Desktop provides scalable virtual desktop infrastructure for temporary employees without requiring personal devices. Azure AD Conditional Access enforces security policies based on device compliance and user risk. Microsoft Defender for Cloud Apps provides additional visibility and control over cloud application access. This combination addresses the need for secure, scalable access to on-premises resources while maintaining the security policy that prevents personal device usage.
Why the other options are wrong
- B. Split tunnel VPN configuration doesn't provide the scalability or device management controls needed for temporary employees and doesn't prevent personal device usage.
- C. Endpoint Manager alone doesn't provide virtual desktop infrastructure needed to avoid personal device usage; it primarily manages enrolled devices rather than providing remote access alternatives.
- D. Migrating all on-premises applications to cloud is not feasible within a brief period and doesn't address the immediate need for temporary employee access.
Question 21
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are designing the encryption standards for data at rest for an Azure resource. You need to provide recommendations to ensure that the data at rest is encrypted by using AES-256 keys. The solution must support rotating the encryption keys monthly. Solution: For blob containers in Azure Storage, you recommend encryption that uses Microsoft-managed keys within an encryption scope. Does this meet the goal?
Show answer and explanation
Correct answer: B. No
Microsoft-managed keys within an encryption scope do not meet the goal because you cannot rotate Microsoft-managed keys on a monthly basis. Microsoft handles key rotation automatically but on their own schedule, typically annually. The requirement explicitly demands monthly key rotation capability, which is only possible with customer-managed keys (CMKs) where you control the rotation policy.
Why the other options are wrong
- A. This is incorrect because Microsoft-managed keys do not provide the ability to perform monthly key rotations; rotation is managed by Microsoft on their timeline.
Question 22
You have a Microsoft Entra tenant named contoso.onmicrosoft.com and an Azure subscription named Sub1. You need to implement Microsoft Entra Verified ID by using Quick Verified ID setup. What should you create first?
Show answer and explanation
Correct answer: B. a custom domain in contoso.onmicrosoft.com
Quick Verified ID setup uses a Microsoft-managed signing key, so no key vault or other Azure resources are needed. Its prerequisite is a custom domain registered and verified in the Microsoft Entra tenant, which becomes the issuer's decentralized identifier, so the custom domain must be created first.
Why the other options are wrong
- A. Quick setup does not require you to create a security principal beforehand.
- C. A managed identity is not part of Quick Verified ID setup.
- D. Quick setup uses Microsoft-managed keys, so a key vault is only needed for the advanced setup.
Question 23
Your company has an Azure subscription that uses Microsoft Defender for Cloud. The company signs a contract with the United States government. You need to review the current subscription for NIST 800-53 compliance. What should you do first?
Show answer and explanation
Correct answer: C. From Microsoft Defender for Cloud, turn on a security standard.
The regulatory compliance dashboard in Microsoft Defender for Cloud only reports on standards that have been added to the subscription. NIST SP 800-53 is not applied by default, so the first action is to turn on that security standard for the subscription. Once the standard is enabled, Defender for Cloud assesses the existing resources against every control in it and the compliance view is populated. Everything else in the review depends on that assessment existing first.
Why the other options are wrong
- A. Assigning a single built-in policy definition covers one control, not the NIST 800-53 control set, and it does not surface a compliance view for the standard.
- B. Defender for Cloud Apps access policies govern sessions to cloud applications. They have no role in assessing an Azure subscription against a regulatory standard.
- D. Secure score recommendations are a general posture measure. They are not mapped to NIST 800-53 controls until the standard itself is enabled.
Question 24
You have legacy operational technology (OT) devices and IoT devices. You need to recommend best practices for applying Zero Trust principles to the OT and IoT devices based on the Microsoft Cybersecurity Reference Architectures (MCRA). The solution must minimize the risk of disrupting business operations. Which two security methodologies should you include in the recommendation? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: B, D. threat monitoring; passive traffic monitoring
For legacy OT and IoT devices, passive traffic monitoring (D) observes network behavior without disrupting operations, making it ideal for devices that cannot tolerate active scanning or updates. Threat monitoring (B) provides continuous detection of security incidents and anomalies. These two passive methodologies align with the MCRA guidance for Zero Trust in OT/IoT environments while minimizing operational disruption to critical systems.
Why the other options are wrong
- A. Active scanning can disrupt or crash legacy OT/IoT devices that weren't designed to handle probing traffic.
- C. Software patching for legacy OT/IoT devices often introduces compatibility issues and business disruption; these systems are typically air-gapped or carefully managed separately.
Question 25
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are designing the encryption standards for data at rest for an Azure resource. You need to provide recommendations to ensure that the data at rest is encrypted by using AES-256 keys. The solution must support rotating the encryption keys monthly. Solution: For Azure SQL databases, you recommend Transparent Data Encryption (TDE) that uses Microsoft-managed keys. Does this meet the goal?
Show answer and explanation
Correct answer: B. No
Transparent Data Encryption (TDE) with Microsoft-managed keys does not meet the goal because, like other Microsoft-managed encryption solutions, you cannot control the key rotation schedule. Microsoft manages TDE key rotation automatically according to their own policies, typically annually. The requirement for monthly key rotation capability necessitates customer-managed keys with Azure Key Vault, where you maintain explicit control over rotation policies.
Why the other options are wrong
- A. This is incorrect because TDE with Microsoft-managed keys does not provide monthly key rotation control; rotation is managed by Microsoft on their schedule.
Question 26
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your on-premises network contains an e-commerce web app that was developed in Angular and Node,js. The web app uses a MongoDB database. You plan to migrate the web app to Azure. The solution architecture team proposes the following architecture as an Azure landing zone. You need to provide recommendations to secure the connection between the web app and the database. The solution must follow the Zero Trust model. Solution: You recommend implementing Azure Front Door with Azure Web Application Firewall (WAF). Does this meet the goal?
Show answer and explanation
Correct answer: B. No
The question asks about securing the connection between the web app and the database following the Zero Trust model. Azure Front Door with WAF addresses north-south traffic (client to web app), but does not secure the east-west connection between the Azure App Service Web App and Azure Cosmos DB. Zero Trust requires securing all connections, including database access. The solution should implement network isolation (VNet integration), managed identities for authentication, Azure Private Endpoints for database connectivity, and encryption in transit/at rest. Front Door and WAF alone do not meet the Zero Trust requirement for app-to-database security.
Why the other options are wrong
- A. Azure Front Door with WAF protects the web app from external threats but does not secure or verify the internal connection between the web app and Cosmos DB, which is essential for Zero Trust.
Question 27
Your company plans to apply the Zero Trust Rapid Modernization Plan (RaMP) to its IT environment. You need to recommend the top three modernization areas to prioritize as part of the plan. Which three areas should you recommend based on RaMP? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, C, E. data, compliance, and governance; user access and productivity; modern security operations
The Rapid Modernization Plan (RaMP) for Zero Trust identifies three critical modernization areas: (A) Data, Compliance, and Governance ensures protection and proper handling of sensitive information; (C) User Access and Productivity focuses on authentication, authorization, and identity verification; and (E) Modern Security Operations implements detection, monitoring, and response capabilities. These three pillars form the foundation of Zero Trust implementation and are universally recommended as top priorities.
Why the other options are wrong
- B. Infrastructure and development are important but not identified as top three RaMP priority areas.
- D. OT and IoT are specialized areas that may be addressed after core Zero Trust infrastructure is established.
Question 28
You have a Microsoft 365 subscription that contains 1,000 users and a group named Group1. All the users have Windows 11 devices. The users sign in to their devices by using their Microsoft Entra account. The users do NOT have administrative rights to their devices. The members of Group1 remotely assist the users by taking control of user sessions. The remote control sessions run in the security context of the users they are assisting. You need to recommend a solution that will enable the Group1 members to run apps that require administrative rights to the users' devices. The solution must ensure that the apps are run in the context of each signed-in standard user. What should you include in the recommendation?
Show answer and explanation
Correct answer: C. Microsoft Intune Endpoint Privilege Management
Microsoft Intune Endpoint Privilege Management (EPM) is specifically designed to allow standard users to run applications requiring administrative rights without granting full administrative privileges. It enables just-in-time privilege elevation for specified applications while maintaining the security context of the signed-in user, which is exactly what remote support staff need when assisting users.
Why the other options are wrong
- A. Windows LAPS manages local administrator passwords but doesn't provide application-level privilege elevation for standard users.
- B. Microsoft Entra Permissions Management focuses on cloud resource access governance, not local application execution privileges.
- D. PIM is for managing privileged identity access in Entra ID, not for elevating application privileges on Windows devices.
Question 29
Your company has an Azure subscription that has enhanced security enabled for Microsoft Defender for Cloud. The company signs a contract with the United States government. You need to review the current subscription for NIST 800-53 compliance. What should you do first?
Show answer and explanation
Correct answer: A. From Azure Policy, assign a built-in initiative that has a scope of the subscription.
To evaluate NIST 800-53 compliance, the first step is to assign a built-in Azure Policy initiative scoped to the subscription that maps to NIST 800-53 controls. Azure Policy provides the foundational compliance assessment framework that evaluates resources against regulatory standards. This establishes the baseline compliance posture before reviewing individual security baselines or configuring additional monitoring tools.
Why the other options are wrong
- B. Microsoft Sentinel is a SIEM tool for log aggregation and threat detection, not the primary mechanism for compliance framework assessment.
- C. The Azure security baseline is a supplementary hardening guide, not the primary tool for formal NIST 800-53 compliance evaluation.
- D. Microsoft Defender for Cloud Apps manages cloud application access and is not focused on infrastructure compliance assessment for NIST 800-53.
Question 30
You have a Microsoft 365 subscription. You have an Azure subscription. You need to implement a Microsoft Purview communication compliance solution for Microsoft Teams and Yammer. The solution must meet the following requirements: • Assign compliance policies to Microsoft 365 groups based on custom Microsoft Exchange Online attributes. • Minimize the number of compliance policies. • Minimize administrative effort. What should you include in the solution?
Show answer and explanation
Correct answer: A. adaptive scopes
Adaptive scopes in Microsoft Purview communication compliance allow policies to be assigned to Microsoft 365 groups based on custom attributes, including Exchange Online attributes. This enables dynamic group targeting that minimizes the number of policies needed and reduces administrative effort compared to manually managing individual policies.
Why the other options are wrong
- B. Microsoft 365 Defender user tags are for threat detection tagging, not for communication compliance policy assignment.
- C. Administrative units are used for role-based access control delegation, not for targeting communication compliance policies.
- D. Sensitivity labels are for document classification, not for targeting communication compliance policies to groups.
Question 31
You have an Azure subscription that is linked to a Microsoft Entra tenant. You plan deploy an enterprise application named App1. App1 requires LDAP to look up attributes related to Microsoft Entra users. You need to recommend a solution to support the LDAP requirement. What should you recommend?
Show answer and explanation
Correct answer: C. Deploy Microsoft Entra Domain Services.
Microsoft Entra Domain Services provides LDAP protocol support, allowing legacy applications that require LDAP to query and authenticate against Microsoft Entra user objects. It creates a managed domain that implements LDAP services, enabling App1 to perform LDAP attribute lookups against Microsoft Entra users.
Why the other options are wrong
- A. Conditional Access policies control access conditions but don't provide LDAP protocol support.
- B. Microsoft Entra Private Access provides Zero Trust network access but doesn't implement LDAP services.
- D. Pass-through authentication handles password validation but doesn't provide LDAP protocol support for directory queries.
Question 32
Your network contains an on-premises Active Directory Domain Services (AD DS) domain named Domain1. Domain1 contains 10 domain controllers. You have an Azure subscription named Sub1 that contains a Microsoft Sentinel workspace named WS1. You have a Microsoft 365 subscription that contains 5,000 users. Each user is assigned a Microsoft 365 E3 license. You need to recommend a solution to ingest security logs from all the domain controllers into WS1. The solution must meet the following requirements: • The cost of ingesting data into WS1 must be minimized. • WS1 must ingest all the Windows Security event logs generated by the domain controllers. • The solution must support the generation of approximately 350 MB of logs per day from each domain controller. What should you recommend?
Show answer and explanation
Correct answer: B. Onboard each domain controller to Microsoft Defender for Servers Plan 2.
Microsoft Defender for Servers Plan 2 includes integration with Microsoft Sentinel and provides a cost-effective way to ingest security logs. When domain controllers are onboarded to Defender for Servers Plan 2, their security event logs are ingested into Sentinel with optimized cost structure. This avoids standard log ingestion costs while still capturing all Windows Security event logs and handling the 350 MB daily volume per controller.
Why the other options are wrong
- A. Upgrading to Microsoft 365 E5 is unnecessary; the E3 licenses are sufficient and this approach doesn't directly solve the log ingestion cost issue.
- C. Auxiliary logs still incur full ingestion costs and don't minimize expenses.
- D. A volume cap would prevent ingestion of necessary logs, violating the requirement to ingest all Windows Security events.
- E. Ingesting from only one domain controller fails to meet the requirement of capturing logs from all 10 domain controllers.
Question 33
You are designing a security operations strategy based on the Zero Trust framework. You need to minimize the operational load on Tier 1 Microsoft Security Operations Center (SOC) analysts. What should you do?
Show answer and explanation
Correct answer: B. Enable self-healing in Microsoft 365 Defender.
Self-healing in Microsoft 365 Defender automatically detects and remediates security threats without requiring analyst intervention, directly reducing operational load on Tier 1 SOC analysts. Automated remediation actions such as isolating devices, blocking users, or removing malware execute immediately upon threat detection, allowing analysts to focus on complex investigations rather than routine response tasks.
Why the other options are wrong
- A. Compliance policies in Azure Policy enforce configuration standards but do not automate threat response or reduce SOC operational load.
- C. Automating data classification improves data governance but does not reduce the operational burden of responding to security incidents.
- D. Creating hunting queries requires analyst expertise and effort; these are proactive investigative tools that increase rather than decrease analyst workload.
Question 34
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that has Microsoft Defender for Cloud enabled. You are evaluating the Azure Security Benchmark V3 report. In the Secure management ports controls, you discover that you have 0 out of a potential 8 points. You need to recommend configurations to increase the score of the Secure management ports controls. Solution: You recommend enabling the VMAccess extension on all virtual machines. Does this meet the goal?
Show answer and explanation
Correct answer: B. No
The VMAccess extension enables remote password management on virtual machines but does not secure or harden management ports. Secure management ports controls focus on restricting access to ports like RDP (3389) and SSH (22) through network security groups, just-in-time access, or similar controls. Enabling VMAccess does not address port security or access controls required by this benchmark.
Why the other options are wrong
- A. Answering yes assumes the VMAccess extension does something about port exposure. It only resets local credentials and SSH keys, so the management ports stay open exactly as they were and the control still scores zero.
Question 35
You have 10 Azure subscriptions that contain 100 role-based access control (RBAC) role assignments. You plan to consolidate the role assignments. You need to recommend a solution to identify which role assignments were NOT used during the last 90 days. The solution must minimize administrative effort. What should you include in the recommendation?
Show answer and explanation
Correct answer: D. Microsoft Entra Permissions Management
Microsoft Entra Permissions Management is specifically designed to discover, remediate, and monitor unused role assignments and permissions across cloud infrastructure. It provides visibility into which role assignments have not been used during specified time periods (like 90 days) and helps identify excessive permissions for consolidation, requiring minimal administrative effort compared to manual audits.
Why the other options are wrong
- A. Microsoft Defender for Cloud focuses on security posture and threat detection, not on identifying unused RBAC role assignments.
- B. Microsoft Entra access reviews are manual review processes requiring administrative participation rather than automated discovery of unused roles.
- C. Microsoft Entra PIM manages privileged access activation and approval workflows, not discovery of unused role assignments.
Question 36
You have Microsoft Defender for Cloud assigned to Azure management groups. You have a Microsoft Sentinel deployment. During the triage of alerts, you require additional information about the security events, including suggestions for remediation. Which two components can you use to achieve the goal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, C. Microsoft Sentinel threat intelligence workbooks; threat intelligence reports in Defender for Cloud
Microsoft Sentinel threat intelligence workbooks provide context about threats and indicators of compromise to support investigation. Threat intelligence reports in Defender for Cloud offer detailed analysis and remediation suggestions for security findings. Both components supply additional investigative context and remediation guidance needed for effective alert triage.
Why the other options are wrong
- B. Sentinel notebooks are primarily for data analysis and custom investigations, not specifically designed to provide remediation suggestions.
- D. Workload protections in Defender for Cloud provide protection capabilities but are not specifically designed to provide remediation suggestions for alert triage.
Question 37
You have an on-premises network and a Microsoft 365 subscription. You are designing a Zero Trust security strategy. Which two security controls should you include as part of the Zero Trust solution? Each correct answer presents part of the solution. NOTE: Each correct answer is worth one point.
Show answer and explanation
Correct answer: C, D. Block sign-in attempts from unknown locations; Block sign-in attempts from noncompliant devices.
Zero Trust principles require verifying every access request regardless of origin and ensuring device compliance before granting access. Option C (block sign-in from unknown locations) implements continuous verification of access context, while option D (block noncompliant devices) enforces device compliance requirements. Together, these controls embody core Zero Trust tenets of "never trust, always verify" and conditional access based on device posture.
Why the other options are wrong
- A. Allowing connections from on-premises networks without verification contradicts Zero Trust principles which mandate continuous validation of all access.
- B. Disabling passwordless sign-in reduces security rather than enhancing it; Zero Trust supports modern passwordless authentication methods like Windows Hello and FIDO2.
Question 38
You have an Azure AD tenant that syncs with an Active Directory Domain Services (AD DS) domain. Client computers run Windows and are hybrid-joined to Azure AD. You are designing a strategy to protect endpoints against ransomware. The strategy follows Microsoft Security Best Practices. You plan to remove all the domain accounts from the Administrators groups on the Windows computers. You need to recommend a solution that will provide users with administrative access to the Windows computers only when access is required. The solution must minimize the lateral movement of ransomware attacks if an administrator account on a computer is compromised. What should you include in the recommendation?
Show answer and explanation
Correct answer: A. Local Administrator Password Solution (LAPS)
Local Administrator Password Solution (LAPS) is the recommended solution for managing local admin credentials on Windows computers. LAPS automatically generates unique, complex passwords for local administrator accounts and stores them securely in Active Directory, providing just-in-time access only when needed. This prevents standing administrative privileges, significantly reducing ransomware lateral movement by ensuring compromised admin accounts have limited persistent access.
Why the other options are wrong
- B. Azure AD Identity Protection detects anomalous sign-ins but doesn't manage local administrator access or provide just-in-time privilege elevation.
- C. Azure AD PIM manages Azure and cloud resources, not local Windows administrator access for hybrid-joined devices.
- D. PAWs are hardened workstations for admin tasks but don't specifically solve the local admin credential management problem on user workstations.
Question 39
You have a Microsoft 365 subscription that contains 1,000 users. Each user is assigned a Microsoft 365 E5 license. The subscription uses sensitivity labels to classify corporate documents. All the users have Windows 11 devices that are onboarded to Microsoft Defender for Endpoint and are configured to sync files to Microsoft OneDrive. You need to prevent the users from uploading the documents from OneDrive to external websites. What should you include in the solution?
Show answer and explanation
Correct answer: B. Microsoft Purview data loss prevention (DLP)
Microsoft Purview Data Loss Prevention (DLP) integrates with sensitivity labels to detect and prevent unauthorized sharing of classified documents. It can monitor file uploads from OneDrive and block transfers to external websites based on the sensitivity label applied to documents, which directly addresses the requirement.
Why the other options are wrong
- A. Microsoft Purview Information Protection focuses on classifying and protecting data through labeling but doesn't prevent uploads to external sites.
- C. Web content filtering in Defender for Endpoint blocks access to websites but cannot intelligently prevent uploads based on document classification.
- D. An endpoint security policy is too generic and doesn't provide the document classification-aware prevention that DLP offers.
Question 40
You have multiple Azure subscriptions that each contains multiple resource groups. You need to identify the privileged role assignments in each subscription and any associated security risks. The solution must minimize administrative effort. What should you use?
Show answer and explanation
Correct answer: D. the Analytics dashboard in Microsoft Entra Permissions Management
The Analytics dashboard in Microsoft Entra Permissions Management automatically discovers identities and their role assignments across all subscriptions and highlights privileged and over-permissioned access and its risk. It needs no per-subscription review configuration, which minimizes administrative effort.
Why the other options are wrong
- A. PIM access reviews must be configured per role or scope and ask reviewers to attest access, rather than automatically surfacing risks across subscriptions.
- B. Identity Governance access reviews recertify group, app and role membership but do not analyze privileged role risk across subscriptions.
- C. Defender EASM discovers internet-facing assets and does not analyze role assignments.
Question 41
You have an Azure subscription that contains several storage accounts. The storage accounts are accessed by legacy applications that are authenticated by using access keys. You need to recommend a solution to prevent new applications from obtaining the access keys of the storage accounts. The solution must minimize the impact on the legacy applications. What should you include in the recommendation?
Show answer and explanation
Correct answer: B. Apply read-only locks on the storage accounts.
A read-only lock blocks write-type operations on the storage account, and listing the account keys is a POST action, so new applications can no longer retrieve the keys. Legacy applications that already hold the keys keep authenticating and working with the data because data plane access is unaffected. This meets the goal with minimal impact on the legacy applications.
Why the other options are wrong
- A. Setting AllowSharedKeyAccess to false disables Shared Key authorization entirely, which would break the legacy applications that rely on access keys.
- C. AllowBlobPublicAccess only controls anonymous public access to blobs and has nothing to do with retrieving account keys.
- D. Key rotation changes the keys periodically but any application with the right permissions can still obtain the new keys, and rotation would disrupt the legacy applications.
Question 42
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that has Microsoft Defender for Cloud enabled. You are evaluating the Azure Security Benchmark V3 report. In the Secure management ports controls, you discover that you have 0 out of a potential 8 points. You need to recommend configurations to increase the score of the Secure management ports controls. Solution: You recommend onboarding all virtual machines to Microsoft Defender for Endpoint. Does this meet the goal?
Show answer and explanation
Correct answer: B. No
Onboarding virtual machines to Microsoft Defender for Endpoint does not directly address the 'Secure management ports' control requirement in Azure Security Benchmark V3. Defender for Endpoint focuses on threat detection and endpoint protection, not on securing or restricting access to management ports like RDP and SSH, which is what the control actually measures.
Why the other options are wrong
- A. This incorrectly suggests that Defender for Endpoint onboarding meets the goal; it does not directly secure management ports as required by the control.
Question 43
You have 50 Azure subscriptions. You need to monitor the resource in the subscriptions for compliance with the ISO 27001:2013 standards. The solution must minimize the effort required to modify the list of monitored policy definitions for the subscriptions. What are two ways to achieve the goal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, F. Assign an initiative to a management group; Assign a blueprint to a management group.
Assigning an initiative to a management group (option A) allows a single assignment to apply multiple policy definitions across all 50 subscriptions under that management group, minimizing modification effort. Azure Blueprints assigned to a management group (option F) can similarly scale policy and compliance definitions across multiple subscriptions with a single assignment. Both approaches reduce the effort needed to maintain and modify policy definitions across many subscriptions.
Why the other options are wrong
- B. Assigning a policy to each subscription requires 50 separate assignments and modifications, maximizing effort.
- C. Assigning a policy to a management group only applies one policy, not an initiative with multiple definitions needed for ISO 27001:2013.
- D. Assigning an initiative to each subscription requires 50 separate assignments and modifications, maximizing effort.
- E. Assigning a blueprint to each subscription requires 50 separate assignments and modifications, maximizing effort.
Question 44
You have a Microsoft Entra tenant that contains 10 Windows 11 devices and two groups named Group1 and Group2. The Windows 11 devices are joined to the Microsoft Entra tenant and are managed by using Microsoft Intune. You are designing a privileged access strategy based on the rapid modernization plan (RaMP). The strategy will include the following configurations: • Each user in Group1 will be assigned a Windows 11 device that will be configured as a privileged access device. • The Security Administrator role will be mapped to the privileged access security level. • The users in Group1 will be assigned the Security Administrator role. • The users in Group2 will manage the privileged access devices. You need to configure the local Administrators group for each privileged access device. The solution must follow the principle of least privilege. What should you include in the solution?
Show answer and explanation
Correct answer: C. Add Group2 to the local Administrators group. Add the user that is assigned the Security Administrator role to the local Administrators group of the user's assigned privileged access device.
This configuration follows least privilege by granting Group2 administrative access to manage the devices while allowing individual users with Security Administrator role access only to their own assigned device. This separation of duties ensures device management is handled by dedicated administrators while privileged users have minimal administrative scope, strictly limited to their personal device.
Why the other options are wrong
- A. Adding only Group2 denies the Security Administrator users administrative access to their own privileged access devices, violating the requirement that users in Group1 have appropriate administrative capabilities.
- B. Windows LAPS legacy emulation mode is outdated; modern Microsoft LAPS provides superior credential management and should be used instead for privileged access devices.
Question 45
You are designing the security standards for a new Azure environment. You need to design a privileged identity strategy based on the Zero Trust model. Which framework should you follow to create the design?
Show answer and explanation
Correct answer: C. Rapid Modernization Plan (RaMP)
Microsoft's privileged access strategy, aligned with Zero Trust, is delivered through the Rapid Modernization Plan (RaMP). RaMP replaces the older ESAE model with a prioritized plan for securing privileged accounts, intermediaries and interfaces.
Why the other options are wrong
- A. SDL is a framework for building secure software, not for designing privileged identity strategy.
- B. ESAE (Red Forest) is a legacy on-premises model that Microsoft no longer recommends for privileged access.
- D. OSA covers operational security of cloud services, not privileged identity design.
Question 46
You have a customer that has a Microsoft 365 subscription and an Azure subscription. The customer has devices that run either Windows, iOS, Android, or macOS. The Windows devices are deployed on-premises and in Azure. You need to design a security solution to assess whether all the devices meet the customer's compliance rules. What should you include in the solution?
Show answer and explanation
Correct answer: B. Microsoft Endpoint Manager
Microsoft Endpoint Manager (Intune) is the unified endpoint management solution that can assess compliance across Windows, iOS, Android, and macOS devices, both on-premises and in cloud environments. It provides compliance policies, device compliance assessment, and reporting capabilities needed to verify devices meet organizational compliance rules across all platforms.
Why the other options are wrong
- A. Microsoft Defender for Endpoint primarily focuses on threat detection and response for Windows and some macOS devices, not general compliance assessment across all platforms.
- C. Microsoft Information Protection is focused on data classification and protection, not device compliance assessment.
- D. Microsoft Sentinel is a SIEM solution for security monitoring and incident response, not a device compliance assessment tool.
Question 47
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are designing a security strategy for providing access to Azure App Service web apps through an Azure Front Door instance. You need to recommend a solution to ensure that the web apps only allow access through the Front Door instance. Solution: You recommend access restrictions to allow traffic from the backend IP address of the Front Door instance. Does this meet the goal?
Show answer and explanation
Correct answer: B. No
Restricting access based on the backend IP address of Front Door does not adequately meet the goal because Front Door uses dynamic IP addresses that can change. Additionally, this approach is vulnerable to IP spoofing and doesn't provide a reliable, secure mechanism to ensure traffic originates specifically from the Front Door instance. A more robust solution requires validating the Front Door's identity through headers or service tags rather than relying on backend IP addresses.
Why the other options are wrong
- A. Using backend IP addresses is unreliable and insecure because these IPs can change, and IP-based restrictions can be spoofed, making this an inadequate security control for ensuring exclusive Front Door access.
Question 48
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that has Microsoft Defender for Cloud enabled. You are evaluating the Azure Security Benchmark V3 report. In the Secure management ports controls, you discover that you have 0 out of a potential 8 points. You need to recommend configurations to increase the score of the Secure management ports controls. Solution: You recommend enabling just-in-time (JIT) VM access on all virtual machines. Does this meet the goal?
Show answer and explanation
Correct answer: A. Yes
Just-in-time (JIT) VM access is a direct control that addresses the Azure Security Benchmark V3's 'Secure management ports' requirement. JIT restricts access to management ports like RDP (3389) and SSH (22) by default and only opens them when needed for legitimate administrative access, which directly improves the score for this security control.
Why the other options are wrong
- B. This incorrectly states that JIT VM access does not meet the goal, when in fact it is specifically designed to secure management ports.
Question 49
You have an on-premises server named Server1. Server1 is an FTP server that can be accessed by only the users at your company. You have an Azure subscription. You need to recommend a Zero Trust Network Access (ZTNA) solution to enforce Conditional Access policies when users access Server1 from the internet. What should you include in the recommendation?
Show answer and explanation
Correct answer: C. Microsoft Entra Private Access
Microsoft Entra Private Access is the Zero Trust Network Access solution that provides secure access to private resources and enforces Conditional Access policies for users accessing on-premises applications like the FTP server from the internet. It enables zero-trust principles by verifying device compliance and applying Conditional Access before granting access.
Why the other options are wrong
- A. Application Proxy is for publishing on-premises web applications but is designed for HTTP/HTTPS protocols, not FTP.
- B. Microsoft Entra Internet Access is for controlling outbound internet traffic, not for accessing on-premises resources.
- D. Azure Application Gateway is a load balancer and WAF service, not a Zero Trust Network Access solution.
- E. Azure Bastion provides secure RDP/SSH access but does not enforce Conditional Access policies for FTP or generic protocols.
Question 50
Your company is preparing for cloud adoption. You are designing security for Azure landing zones. Which two preventative controls can you implement to increase the secure score? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, D. Azure Web Application Firewall (WAF); Azure Firewall
Azure Web Application Firewall and Azure Firewall block malicious traffic before it reaches workloads, which makes them preventative controls. Defender for Cloud recommendations for enabling WAF and routing traffic through Azure Firewall feed secure score controls, so implementing them raises the score.
Why the other options are wrong
- B. PIM reduces standing privilege, but it is an identity governance feature rather than a network preventative control counted by these secure score recommendations.
- C. Microsoft Sentinel is a SIEM that detects and responds to threats, which makes it a detective control.
- E. Alerts notify you after suspicious activity occurs, so they are detective rather than preventative.
Question 51
You have a Microsoft Entra tenant. The tenant contains 500 Windows devices that have the Global Secure Access client deployed. You have a third-party software as a service (SaaS) app named App1. You plan to implement Global Secure Access to manage access to App1. You need to recommend a solution to manage connections to App1. The solution must ensure that users authenticate by using their Microsoft Entra credentials before they can connect to App1. What should you include the recommendation?
Show answer and explanation
Correct answer: A. a Global Secure Access app
To review NIST 800-53 compliance, you must first add the regulatory compliance standard to Defender for Cloud. This is the foundational step that enables compliance assessment against NIST 800-53 requirements. Once added, Defender for Cloud will assess your subscription against this standard and provide compliance reports.
Why the other options are wrong
- B. Azure Policy is for enforcing governance rules, not for compliance assessment and reporting against specific regulatory standards like NIST 800-53.
- C. The Azure security baseline is a general security benchmark, not specifically designed for NIST 800-53 compliance review.
- D. Microsoft Defender for Cloud Apps manages cloud application security and is not the appropriate tool for regulatory compliance assessment.
Question 52
You have an Azure subscription that has Microsoft Defender for Cloud enabled. You need to enforce ISO 27001:2013 standards for the subscription. The solution must ensure that noncompliant resources are remediated automatically. What should you use?
Show answer and explanation
Correct answer: A. Azure Policy
Azure Policy is the service that enforces compliance standards and can automatically remediate noncompliant resources through remediation tasks. Policy definitions can be assigned to enforce ISO 27001:2013 standards across the subscription, and remediation can be applied automatically to bring resources into compliance.
Why the other options are wrong
- B. Azure Blueprints is for deploying templated environments and doesn't provide ongoing compliance enforcement or automatic remediation.
- C. The regulatory compliance dashboard displays compliance status but doesn't enforce standards or perform automatic remediation.
- D. Azure RBAC controls access permissions but does not enforce compliance standards or remediate noncompliant resources.
Question 53
You have a Microsoft 365 subscription that contains a group named Group1. The subscription contains 1,000 Windows devices that are joined to a Microsoft Entra tenant and managed by using Microsoft Intune. All users sign in to the devices by using standard user accounts. You plan to deploy a new app named App1 to the members of Group1. The Group1 members must have administrative rights to install new versions of App1. You need to ensure that the Group1 members can install new versions of App1. The solution must follow the principles of Zero Trust. What should you implement?
Show answer and explanation
Correct answer: B. Microsoft Intune Endpoint Privilege Management (EPM)
Microsoft Intune Endpoint Privilege Management (EPM) allows standard users to request and obtain elevated privileges for specific applications or operations on a just-in-time basis with approval workflows. This aligns perfectly with Zero Trust principles by granting minimal necessary privileges only when needed, without requiring permanent administrative rights or complex PIM configurations that are designed for Azure administrative roles rather than application-level access.
Why the other options are wrong
- A. PIM manages Azure AD role assignments and administrative access, not application-level privileges on managed endpoints.
- C. Microsoft LAPS manages local administrator passwords but does not provide the granular, application-specific just-in-time elevation required for this scenario.
- D. Entitlement management handles resource access and group membership, not the elevation of privileges for application installation on endpoints.
Question 54
You have a Microsoft 365 subscription that contains 1,000 Microsoft Exchange Online mailboxes. Incoming email from the internet is scanned for security threats by using a third-party cloud service. You are evaluating whether to replace the third-party service with Microsoft Defender for Office 365. What should you modify to ensure that all the incoming email is scanned by Defender for Office 365 only?
Show answer and explanation
Correct answer: B. the DNS records
When enhanced security is already enabled in Defender for Cloud, the next step for NIST 800-53 compliance review is to assign a built-in Azure Policy initiative at the subscription scope. This establishes the policy framework that enforces NIST 800-53 control requirements across all resources.
Why the other options are wrong
- A. Defender plans are already enabled per the scenario; this is not the appropriate next step.
- C. Reviewing secure score recommendations addresses security posture but is not the first step for NIST 800-53 compliance review.
- D. Microsoft Defender for Cloud Apps policies manage cloud application security, not NIST 800-53 compliance requirements.
Question 55
You have a Microsoft 365 subscription that uses Microsoft Purview. You need to recommend a solution that will provide guidance on how to ensure that Personally Identifiable Information (PII) in the subscription adheres to local privacy regulations. The solution must minimize administrative effort. Which Microsoft Purview solution should you include in the recommendation?
Show answer and explanation
Correct answer: D. Compliance Manager
Microsoft Purview Compliance Manager provides guidance, recommendations, and compliance scoring to help organizations understand and improve their compliance posture with regulations like GDPR, CCPA, and other privacy laws. It offers actionable improvement actions and continuous monitoring, minimizing administrative effort while ensuring PII handling adheres to local privacy regulations.
Why the other options are wrong
- A. Data Loss Prevention focuses on preventing data leakage, not providing regulatory compliance guidance.
- B. Information Protection handles encryption and classification but doesn't provide compliance guidance for privacy regulations.
- C. Insider Risk Management detects risky user behaviors, not privacy regulation compliance assessment.
Question 56
You have an Azure AD tenant that syncs with an Active Directory Domain Services (AD DS) domain. You are designing an Azure DevOps solution to deploy applications to an Azure subscription by using continuous integration and continuous deployment (CI/CD) pipelines. You need to recommend which types of identities to use for the deployment credentials of the service connection. The solution must follow DevSecOps best practices from the Microsoft Cloud Adoption Framework for Azure. What should you recommend?
Show answer and explanation
Correct answer: A. a managed identity in Azure
Managed identities in Azure are the DevSecOps best practice for CI/CD pipeline service connections according to Microsoft Cloud Adoption Framework. Managed identities eliminate credential management burden, provide automatic credential rotation, enable fine-grained role-based access control through Azure RBAC, and require no secret storage or maintenance, fully aligning with modern security best practices.
Why the other options are wrong
- B. Using individual Azure AD user accounts violates least privilege and DevSecOps principles; user accounts should not be used for automation.
- C. Group managed service accounts are on-premises AD constructs and do not apply to Azure DevOps service connections in the cloud.
- D. Storing passwords in Key Vault introduces unnecessary secrets management and is inferior to managed identity which requires no credentials at all.
Question 57
You have Windows 11 devices and Microsoft 365 E5 licenses. You need to recommend a solution to prevent users from accessing websites that contain adult content such as gambling sites. What should you include in the recommendation?
Show answer and explanation
Correct answer: D. Microsoft Defender for Endpoint
Microsoft Defender for Endpoint includes web content filtering capabilities that allow organizations to block access to websites based on content categories, including adult content and gambling sites. This feature operates at the device level and integrates with Windows 11 and Microsoft 365 E5 to provide endpoint-based web filtering without requiring additional solutions.
Why the other options are wrong
- A. Compliance Manager is designed for regulatory compliance assessment, not web content filtering.
- B. Defender for Cloud Apps focuses on cloud application security and data protection, not general web content filtering.
- C. Endpoint Manager provides device management but web content filtering is a Defender for Endpoint capability.
Question 58
You have a Microsoft 365 subscription and an Azure subscription. Microsoft 365 Defender and Microsoft Defender for Cloud are enabled. The Azure subscription contains 50 virtual machines. Each virtual machine runs different applications on Windows Server 2019. You need to recommend a solution to ensure that only authorized applications can run on the virtual machines. If an unauthorized application attempts to run or be installed, the application must be blocked automatically until an administrator authorizes the application. Which security control should you recommend?
Show answer and explanation
Correct answer: D. application control policies in Microsoft Defender for Endpoint
Application control policies in Microsoft Defender for Endpoint provide the capability to enforce an allowlist of authorized applications on Windows Server machines and automatically block unauthorized application execution and installation. This meets the requirement for automatic blocking until administrator authorization.
Why the other options are wrong
- A. App discovery anomaly detection in Defender for Cloud Apps detects suspicious cloud application activity but does not block unauthorized applications from running on virtual machines.
- B. Azure Security Benchmark compliance controls assess security posture but do not provide application-level control mechanisms.
- C. Azure AD app registrations manage application identity and access to Azure AD resources, not local application execution on Windows servers.
Question 59
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your on-premises network contains an e-commerce web app that was developed in Angular and Node,js. The web app uses a MongoDB database. You plan to migrate the web app to Azure. The solution architecture team proposes the following architecture as an Azure landing zone. You need to provide recommendations to secure the connection between the web app and the database. The solution must follow the Zero Trust model. Solution: You recommend implementing Azure Application Gateway with Azure Web Application Firewall (WAF). Does this meet the goal?
Show answer and explanation
Correct answer: B. No
While Azure Application Gateway with WAF is valuable for protecting the web app from external threats, it does NOT address the specific requirement of securing the connection between the web app and the database in a Zero Trust model. The question asks specifically about securing the web app-to-database connection. Zero Trust principles for this connection require authentication, encryption, and network isolation at the database layer, such as using managed identities, private endpoints, network policies, and encryption in transit/at rest. Application Gateway protects the client-to-web-app connection but does not implement Zero Trust controls for the app-to-database communication path.
Why the other options are wrong
- A. Application Gateway with WAF secures client-to-app communication but fails to address Zero Trust requirements for the app-to-database connection layer.
Question 60
Your company has an Azure subscription that has enhanced security enabled for Microsoft Defender for Cloud. The company signs a contract with the United States government. You need to review the current subscription for NIST 800-53 compliance. What should you do first?
Show answer and explanation
Correct answer: D. From Defender for Cloud, add a regulatory compliance standard.
To review compliance against NIST 800-53, the first step is to add the regulatory compliance standard to Defender for Cloud. This enables the NIST 800-53 compliance standard to be tracked and assessed against the subscription's current configuration, providing a baseline and recommendations for meeting that specific government regulation.
Why the other options are wrong
- A. Reviewing secure score recommendations is helpful but doesn't specifically enable NIST 800-53 compliance assessment.
- B. Configuring the Microsoft Defender for Cloud data connector in Sentinel is for log analysis and incident response, not for regulatory compliance assessment.
- C. Reviewing the Azure security baseline audit report is useful but is not the first step needed to review NIST 800-53 compliance specifically.
Question 61
You have a Microsoft 365 E5 subscription. You need to recommend a solution to add a watermark to email attachments that contain sensitive data. What should you include in the recommendation?
Show answer and explanation
Correct answer: B. Microsoft Information Protection
Microsoft Information Protection provides labeling and protection features that can automatically apply watermarks to documents and email attachments based on sensitivity classifications. This native capability allows organizations to mark sensitive data with watermarks as part of their data protection strategy, directly addressing the requirement to watermark email attachments containing sensitive data.
Why the other options are wrong
- A. Defender for Cloud Apps monitors cloud application usage and threats but is not the primary tool for adding watermarks to attachments.
- C. Insider risk management focuses on detecting risky user behaviors, not on adding watermarks to sensitive data.
- D. Azure Purview is a data governance platform for cataloging and managing data sources, not for applying watermarks to attachments.
Question 62
Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains 500 Windows 11 devices. You have a Microsoft 365 subscription and an Azure subscription. You have a Microsoft Entra tenant that syncs with the domain and is linked to the subscriptions. The devices are Microsoft Entra hybrid joined. You plan to deploy a solution to mitigate attacks against privileged accounts. The solution will include Microsoft Sentinel rules that will detect attempts to use fake cached credentials. You need to recommend a solution to create the fake cached credentials on client computers. What should you recommend?
Show answer and explanation
Correct answer: B. a deception rule in Microsoft Defender for Endpoint
The deception capability in Microsoft Defender for Endpoint deploys lures, such as fake cached credentials and decoy hosts, directly onto real client devices. When an attacker harvests and tries to use one of those planted credentials, an alert is raised that Microsoft Sentinel rules can act on. This is the feature that actually creates fake cached credentials on the Windows 11 endpoints.
Why the other options are wrong
- A. UEBA builds behavioural baselines and flags anomalies, but it does not plant any fake credentials on devices.
- C. A user risk policy responds to risk detected for real accounts, such as leaked credentials, and does not create decoy credentials.
- D. A Honeytoken tag in Defender for Identity marks an existing directory account as a decoy, but it does not place fake cached credentials on client computers.
Question 63
You have an Azure subscription that has Microsoft Defender for Cloud enabled. You have an Amazon Web Services (AWS) implementation. You plan to extend the Azure security strategy to the AWS implementation. The solution will NOT use Azure Arc. Which three services can you use to provide security for the AWS resources? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, C, E. Microsoft Defender for Containers; Azure Active Directory (Azure AD) Conditional Access; Azure Policy
Microsoft Defender for Containers (A) provides security for containerized workloads across AWS. Azure Policy (E) can be extended to AWS through AWS CloudFormation integrations to enforce compliance policies. Microsoft Defender for Servers (C) is not listed here, but looking at the answer set: A provides container security on AWS, C (Azure AD Conditional Access) extends identity controls to AWS-hosted applications, and E (Azure Policy) evaluates compliance across AWS resources. These three provide cross-cloud security without requiring Azure Arc.
Why the other options are wrong
- B. Microsoft Defender for Servers is primarily designed for Azure VMs and on-premises servers connected via Arc, not native AWS resources without Arc.
- D. Azure AD PIM is designed for Azure administrative role management and does not extend to AWS resource protection or access control.
Question 64
You have an Azure subscription that contains virtual machines, storage accounts, and Azure SQL databases. All resources are backed up multiple times a day by using Azure Backup. You are developing a strategy to protect against ransomware attacks. You need to recommend which control must be enabled to ensure that Azure Backup can be used to restore the resources in the event of a successful ransomware attack. Which control should you include in the recommendation?
Show answer and explanation
Correct answer: D. Require PINs for critical operations.
The threat in a ransomware attack is that the attacker reaches the backups and deletes or shortens the retention on them before encrypting the data, leaving nothing to restore from. Azure Backup guards against this with soft delete plus a control that requires a security PIN for critical operations, which are the destructive ones such as deleting backup data or reducing the retention period. Requiring the PIN means an attacker who has compromised an account still cannot destroy the recovery points, so Azure Backup can still restore the resources after the attack.
Why the other options are wrong
- A. Offline backups to Azure Data Box would be a manual, point in time copy. It is not a control you enable on Azure Backup and it does not protect the existing multiple daily backups.
- B. Azure Monitor notifications tell you a configuration changed after the fact. Detection is useful, but it does not stop the deletion, so the backups can still be gone when you need them.
- C. Customer-managed keys control who can decrypt the backup data. They protect confidentiality, not the availability of the recovery points that a ransomware attacker targets.
Question 65
You have a Microsoft 365 subscription that contains a Microsoft SharePoint Online site named Site1. All users are assigned a Microsoft 365 E5 license. You use Microsoft Intune to manage corporate devices. You plan to create a Conditional Access policy that will allow access to Site1 only from devices that are onboarded to Microsoft Defender for Endpoint. You need to ensure that the devices can be evaluated for compliance by using Intune before enforcing the policy. What should you create first?
Show answer and explanation
Correct answer: B. a compliance policy
A Conditional Access policy that requires a compliant device can only work if Intune has a definition of what compliant means. The compliance policy is that definition, and its rules can include the Microsoft Defender for Endpoint machine risk score, which is how onboarding to Defender for Endpoint becomes a compliance signal. Without the compliance policy in place, every device is evaluated against nothing, so the policy has to be created first and given time to evaluate before the Conditional Access rule is enforced.
Why the other options are wrong
- A. A Windows Autopilot deployment profile provisions new devices. It plays no part in evaluating whether an already enrolled device is compliant.
- C. App protection policies apply data protection inside an application on a device that may not be managed at all. They do not produce the device compliance state Conditional Access needs.
- D. App configuration policies deliver settings to a managed app. They do not evaluate device health or produce a compliance verdict.
Question 66
You have a Microsoft 365 subscription that contains a group named Group1. The subscription is linked to a Microsoft Entra ID P1 tenant. You have an external software as a service (SaaS) application named App1. App1 is managed by using a web-based admin portal and supports the use of Microsoft Entra ID credentials. You need to ensure that only the members of Group1 who sign in from Microsoft Entra joined devices can access the admin portal of App1. What should you create first in Microsoft Entra?
Show answer and explanation
Correct answer: A. an enterprise application
To manage access to the external SaaS application App1 through Microsoft Entra, you must first create an enterprise application registration in Microsoft Entra. This allows App1 to authenticate users via Microsoft Entra ID and enables Conditional Access policies to be applied. The enterprise application is the prerequisite that enables the Conditional Access policy to function.
Why the other options are wrong
- B. An Application Proxy connector group is used for on-premises applications, not SaaS applications accessed directly.
- C. While a Conditional Access policy is ultimately needed, it cannot be created or function without first registering the enterprise application.
- D. An access package is used for entitlement management and group membership, not for SaaS application access control.
Question 67
Your network contains an on-premises Active Directory Domain Services (AD DS) domain. You have a Microsoft 365 subscription. You need to recommend a solution to evaluate the security and governance of the domains. The solution must meet the following requirements: • Identify configuration issues and administrative vulnerabilities. • Minimize effort. What should you include in the recommendation?
Show answer and explanation
Correct answer: C. Microsoft Defender for Identity
Microsoft Defender for Identity monitors on-premises Active Directory Domain Services directly through sensors on the domain controllers, and its identity security posture assessments are built exactly for this purpose. They surface configuration issues and administrative vulnerabilities such as unsecure Kerberos delegation, weak or legacy protocol use, dormant privileged accounts, and credentials exposed in clear text, each with a recommended fix. That gives both the security and the governance view of the domains with far less effort than assembling the same picture by hand.
Why the other options are wrong
- A. Microsoft Entra ID Protection scores risk on cloud identities and sign-ins. It does not evaluate the configuration of an on-premises AD DS domain.
- B. Microsoft Defender for Servers protects the operating system of a machine. It reports on server vulnerabilities rather than on directory configuration and administrative practice.
- D. Microsoft Sentinel is a SIEM. It could be made to answer these questions with custom analytics and content, which is considerably more effort than a purpose-built posture assessment.
Question 68
You have a Microsoft Entra tenant named contoso.com. You have an external partner that has a Microsoft Entra tenant named fabnkam.com. You need to recommend an identity governance solution for contoso.com that meets the following requirements: • Enables the users in contoso.com and fabrikam.com to communicate by using shared Microsoft Teams channels • Manages access to shared Teams channels in contoso.com by using groups in fabrikam.com • Supports single sign-on (SSO) • Minimizes administrative effort • Maximizes security What should you include in the recommendation?
Show answer and explanation
Correct answer: C. B2B direct connect
B2B direct connect enables users from fabrikam.com to access shared Teams channels in contoso.com with seamless SSO, supports managing access through groups in the partner tenant, and requires minimal configuration. It maximizes security by providing direct, controlled access patterns and minimizes administrative effort through integrated management, making it ideal for this cross-tenant Teams collaboration scenario.
Why the other options are wrong
- A. Cross-tenant synchronization synchronizes user identities between tenants but does not directly enable Teams channel collaboration or group-based access management for channels.
- B. While B2B collaboration enables guest access, it requires managing individual guest accounts rather than managing access through partner tenant groups, increasing administrative effort.
- D. Microsoft Entra Connect Sync is for on-premises Active Directory synchronization to Azure AD, not for cross-tenant identity governance or Teams collaboration.
Question 69
You have an Azure subscription that has Microsoft Defender for Cloud enabled. You need to enforce ISO 27001:2013 standards for new resources deployed to the subscription. The solution must ensure that noncompliant resources are automatically detected. What should you use?
Show answer and explanation
Correct answer: C. Azure Policy
Azure Policy is the correct solution to enforce ISO 27001:2013 standards and automatically detect noncompliant resources. Azure Policy provides built-in initiatives for ISO 27001:2013 that can automatically evaluate and report on compliance, with the ability to enforce compliance through policy effects.
Why the other options are wrong
- A. Azure Blueprints deploy predefined Azure resources but do not continuously enforce and detect compliance violations.
- B. The regulatory compliance dashboard in Defender for Cloud provides reporting and assessment, not automatic enforcement of standards.
- D. Azure RBAC controls user access and permissions, not resource compliance with security standards.
Question 70
You have an Azure subscription and an Azure DevOps organization. You need to recommend a solution for connecting Azure DevOps pipelines to the resources in the subscription by using Azure Resource Manager (ARM) service connections. The solution must align with Microsoft Cloud Adoption Framework for Azure best practices, including the principle of least privilege. What should you include in the recommendation?
Show answer and explanation
Correct answer: C. workload identity federation and user-assigned managed identities
Workload identity federation combined with user-assigned managed identities provides the most secure and least-privilege approach for Azure DevOps pipelines. This eliminates the need for secrets, follows Cloud Adoption Framework best practices by avoiding credential storage, and allows fine-grained access control through managed identity assignments.
Why the other options are wrong
- A. Service principals with secrets require storing and rotating credentials, violating the least privilege principle and CAF guidance.
- B. While workload identity federation is correct, service principals still require credential management which is less secure than managed identities.
- D. System-assigned managed identities are scoped to individual resources and cannot be flexibly assigned across multiple pipelines or services.
Question 71
You have a Microsoft 365 subscription that contains 1,000 users and a group named Group1. All the users have Windows 11 devices. The users sign in to their devices by using their Microsoft Entra account The users do NOT have administrative rights to their devices. The members of Group1 remotely assist the users by taking control of user sessions. The remote control sessions run in the security context of the users they are assisting. You need to recommend a solution that will enable the Group1 members to run apps that require administrative rights to the users’ devices. The solution must ensure that the apps are run in the context of each signed-in standard user. What should you include in the recommendation?
Show answer and explanation
Correct answer: B. Microsoft Intune Endpoint Privilege Management
Microsoft Intune Endpoint Privilege Management is built for exactly this pattern. It elevates a specific application on demand rather than making the user an administrator, and the elevation happens in the context of the signed-in standard user, which is what the requirement asks for. Because the Group1 members are working inside the user's own session, an elevation rule that targets the required apps lets them run those apps with administrative rights while every user keeps a standard account.
Why the other options are wrong
- A. Microsoft Entra Privileged Identity Management manages just-in-time activation of directory and Azure roles. It does not grant local administrative rights on a Windows device.
- C. Microsoft Entra entitlement management packages access to groups, applications, and sites. It has nothing to do with running a local application with elevated rights.
- D. Windows LAPS manages the password of the local administrator account. Using it means signing in as that separate administrator account, not running the app in the context of the signed-in standard user.
Question 72
Your company has on-premises network in Seattle and an Azure subscription. The on-premises network contains a Remote Desktop server. The company contracts a third-party development firm from France to develop and deploy resources to the virtual machines hosted in the Azure subscription. Currently, the firm establishes an RDP connection to the Remote Desktop server. From the Remote Desktop connection, the firm can access the virtual machines hosted in Azure by using custom administrative tools installed on the Remote Desktop server. All the traffic to the Remote Desktop server is captured by a firewall, and the firewall only allows specific connections from France to the server. You need to recommend a modern security solution based on the Zero Trust model. The solution must minimize latency for developers. Which three actions should you recommend? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: C, D, E. Migrate from the Remote Desktop server to Azure Virtual Desktop; Implement Azure Firewall to restrict host pool outbound access; Configure Azure Active Directory (Azure AD) Conditional Access with multifactor authentication (MFA) and named locations.
Option C (Migrate to Azure Virtual Desktop) eliminates the on-premises Remote Desktop server and modernizes access through cloud-hosted infrastructure. Option D (Azure Firewall for host pool access control) restricts outbound access from the virtual desktop environment to only necessary resources. Option E (Azure AD Conditional Access with MFA and named locations) provides identity-based access control with multi-factor authentication and can incorporate geographic location policies for the France-based developers. Together, these replace IP-based firewall rules with Zero Trust identity and device-based controls while maintaining low latency by hosting VDI in Azure.
Why the other options are wrong
- A. NSG IP-based rules contradict Zero Trust principles, which emphasize identity and device posture over IP addresses, and create maintenance overhead.
- B. Deploying a Remote Desktop server in France merely relocates the legacy architecture rather than modernizing to Zero Trust principles.
Question 73
A customer has a hybrid cloud infrastructure that contains a Microsoft 365 E5 subscription and an Azure subscription. All on-premises servers in the perimeter network are prevented from connecting directly to the internet. The customer recently recovered from a ransomware attack. The customer plans to deploy Microsoft Sentinel. You need to recommend solutions to meet the following requirements: • Ensure that the security operations team can access the security logs and the operation logs. • Ensure that the IT operations team can access only the operations logs, including the event logs of the servers in the perimeter network. Which two solutions should you include in the recommendation? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: B, C. the Azure Monitor agent; resource-based role-based access control (RBAC)
The Azure Monitor agent (B) is the modern replacement for the Log Analytics agent and can collect security and operational logs from on-premises servers, including those in perimeter networks where internet connectivity is restricted. Resource-based RBAC (C) enables granular access control, allowing the security team full access to all logs while restricting the IT operations team to only operational logs. This combination satisfies both requirements for log collection and role-based access control.
Why the other options are wrong
- A. The Log Analytics agent is legacy and less suitable for modern deployments; Azure Monitor agent is the recommended solution.
- D. Conditional Access policies control authentication to cloud services, not data access permissions within Sentinel for different user groups.
Question 74
Your company has an Azure subscription that uses Microsoft Defender for Cloud. The company signs a contract with the United States government. You need to review the current subscription for NIST 800-53 compliance. What should you do first?
Show answer and explanation
Correct answer: D. From Defender for Cloud, add a regulatory compliance standard.
To review NIST 800-53 compliance in Defender for Cloud, you must first add the regulatory compliance standard to your workspace. This step makes NIST 800-53 available as a compliance framework within Defender for Cloud, enabling compliance assessment and reporting.
Why the other options are wrong
- A. Microsoft Sentinel data connectors are for log ingestion and threat detection, not for compliance standard setup.
- B. Microsoft Defender for Cloud Apps access policies manage cloud application security, not regulatory compliance standards.
- C. Enabling Defender plans is a security feature for threat protection, not the initial step for adding regulatory compliance standards.
Question 75
A customer is deploying Docker images to 10 Azure Kubernetes Service (AKS) resources across four Azure subscriptions. You are evaluating the security posture of the customer. You discover that the AKS resources are excluded from the secure score recommendations. You need to produce accurate recommendations and update the secure score. Which two actions should you recommend in Microsoft Defender for Cloud? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, B. Enable Defender plans; Configure auto provisioning.
Enabling Defender plans (specifically Defender for Containers) extends Microsoft Defender for Cloud's coverage to AKS resources, making them visible in secure score recommendations. Configuring auto provisioning ensures that Defender agents are automatically deployed to newly discovered AKS resources, enabling continuous monitoring and accurate security recommendations. These two actions together ensure AKS resources are included in secure score calculations.
Why the other options are wrong
- C. Workflow automation helps respond to alerts but does not update secure score recommendations or include resources in scoring.
- D. Regulatory compliance policies assess compliance but do not directly address secure score or AKS resource inclusion.
- E. Reviewing inventory provides visibility but does not enable the protection mechanisms needed for accurate secure score recommendations.
Question 76
You have a Microsoft 365 subscription. You have an Azure subscription. You need to implement a Microsoft Purview communication compliance solution for Microsoft Teams and Yammer. The solution must meet the following requirements: • Assign compliance policies to Microsoft 365 groups based on custom Microsoft Exchange Online attributes. • Minimize the number of compliance policies. • Minimize administrative effort. What should you include in the solution?
Show answer and explanation
Correct answer: C. adaptive scopes
Adaptive scopes in Microsoft Purview Communication Compliance allow policies to be assigned dynamically to Microsoft 365 groups based on custom attributes (including Exchange Online attributes). This minimizes the number of policies needed and administrative effort by automatically including or excluding groups based on attribute-based rules rather than manually maintaining static group lists.
Why the other options are wrong
- A. Microsoft Purview Information Protection handles data classification and protection, not communication compliance policy assignment.
- B. Microsoft 365 Defender user tags are for threat detection and response, not for scoping communication compliance policies to groups based on attributes.
- D. Administrative units organize users and groups for delegation but do not provide the attribute-based dynamic scoping needed for compliance policies.
Question 77
Your network contains an Active Directory Domain Services (AD DS) domain named Domain1. You have a Microsoft Entra tenant. Domain: 1 syncs with the tenant by using Microsoft Entra Connect. You need to monitor Domain1 for privilege escalation attacks. What should you use?
Show answer and explanation
Correct answer: C. Microsoft Defender for Identity
Microsoft Defender for Identity is specifically designed to monitor Active Directory Domain Services for suspicious activities and attacks, including privilege escalation attempts. It analyzes AD traffic and provides threat intelligence specific to on-premises identity systems, making it the appropriate choice for monitoring Domain1.
Why the other options are wrong
- A. Microsoft Entra ID Protection focuses on cloud identity threats, not on-premises AD threats.
- B. Microsoft Defender for Servers protects servers from malware and vulnerabilities but is not specialized for AD privilege escalation detection.
- D. PIM manages privileged access governance but is not designed for threat monitoring and detection of attacks.
Question 78
You have a Microsoft 365 subscription and an Azure subscription. Microsoft 365 Defender and Microsoft Defender for Cloud are enabled. The Azure subscription contains 50 virtual machines. Each virtual machine runs different applications on Windows Server 2019. You need to recommend a solution to ensure that only authorized applications can run on the virtual machines. If an unauthorized application attempts to run or be installed, the application must be blocked automatically until an administrator authorizes the application. Which security control should you recommend?
Show answer and explanation
Correct answer: A. adaptive application controls in Defender for Cloud
Adaptive application controls in Defender for Cloud is the feature specifically designed to whitelist authorized applications on virtual machines and automatically block unauthorized applications from running or being installed. It learns from the normal application behavior and enforces policies accordingly, meeting the requirement for automatic blocking until administrator authorization.
Why the other options are wrong
- B. App protection policies in Microsoft Endpoint Manager are designed for mobile device management and protecting data on managed devices, not for controlling which applications can run on Windows servers.
- C. App discovery anomaly detection policies in Microsoft Defender for Cloud Apps are designed to detect anomalous application usage in cloud environments, not to block unauthorized applications from running on VMs.
- D. Azure Security Benchmark compliance controls are general compliance frameworks, not specific tools for enforcing application execution policies.
Question 79
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are designing a security strategy for providing access to Azure App Service web apps through an Azure Front Door instance. You need to recommend a solution to ensure that the web apps only allow access through the Front Door instance. Solution: You recommend access restrictions based on HTTP headers that have the Front Door ID. Does this meet the goal?
Show answer and explanation
Correct answer: A. Yes
Restricting access based on HTTP headers containing the Front Door ID effectively meets the goal because Front Door can inject custom headers (such as X-Azure-FDID) into requests it processes. By configuring the App Service to only accept requests with the correct Front Door ID in the HTTP headers, you ensure traffic originates from your specific Front Door instance. This approach is secure because the header is added by Front Door and cannot be easily spoofed by direct requests to the App Service.
Why the other options are wrong
- B. This is incorrect; custom HTTP headers with Front Door ID validation is a secure and effective method to ensure exclusive access through a specific Front Door instance.
Question 80
You have a Microsoft 365 subscription and an Azure subscription. Microsoft 365 Defender and Microsoft Defender for Cloud are enabled. The Azure subscription contains 50 virtual machines. Each virtual machine runs different applications on Windows Server 2019. You need to recommend a solution to ensure that only authorized applications can run on the virtual machines. If an unauthorized application attempts to run or be installed, the application must be blocked automatically until an administrator authorizes the application. Which security control should you recommend?
Show answer and explanation
Correct answer: D. application control policies in Microsoft Defender for Endpoint
Application control policies in Microsoft Defender for Endpoint provide the capability to define which applications are allowed to run on Windows Server machines and can automatically block unauthorized applications. This feature supports the requirement to prevent unauthorized applications from executing and enforces administrator approval before allowing new applications.
Why the other options are wrong
- A. App registrations in Entra ID are for cloud application identity management, not local application control on servers.
- B. OAuth app policies in Defender for Cloud Apps govern cloud application access, not local application execution on virtual machines.
- C. App protection policies in Endpoint Manager are for mobile and managed application protection, not server-level application control.
Question 81
You are evaluating an Azure environment for compliance. You need to design an Azure Policy implementation that can be used to evaluate compliance without changing any resources. Which effect should you use in Azure Policy?
Show answer and explanation
Correct answer: D. Disabled
The 'Disabled' effect in Azure Policy allows policies to be evaluated for compliance assessment without applying any enforcement. When disabled, policies will report on non-compliant resources without denying, modifying, or appending any resources, making it ideal for evaluating compliance in audit-only mode without making any resource changes.
Why the other options are wrong
- A. Deny effect enforces policy by blocking non-compliant resource operations, which modifies behavior and violates the requirement to not change resources.
- B. Modify effect actively changes resource properties to achieve compliance, directly altering resources rather than merely evaluating them.
- C. Append effect adds properties to resources to achieve compliance, which constitutes a resource change rather than pure evaluation.
Question 82
Your on-premises network contains an Active Directory Domain Services (AD DS) domain and a hybrid deployment between a Microsoft Exchange Server 2019 organization and an Exchange Online tenant. The AD DS domain contains a group named Group1. Group1 is a member of the Organization Management role group for the Exchange deployment. You have a Microsoft 365 E5 subscription that uses Microsoft Defender. You have an Azure subscription that uses Microsoft Sentinel. You need to recommend a solution to ensure that Group1 is marked as a sensitive group and that any changes made to Group1 raises an alert in Microsoft Sentinel. The solution must minimize administrative effort. What should you include in the recommendation?
Show answer and explanation
Correct answer: A. Microsoft Defender for Identity
Microsoft Defender for Identity can mark on-premises AD DS groups as sensitive and automatically detects changes to sensitive groups, generating alerts. These alerts can be forwarded to Microsoft Sentinel for centralized monitoring and alerting, meeting all requirements with minimal administrative effort through native integration.
Why the other options are wrong
- B. Microsoft Entra ID Protection focuses on identity risk detection and conditional access responses for cloud identities, not on marking on-premises AD DS groups as sensitive.
- C. Microsoft Entra Privileged Identity Management manages cloud role activation and approval workflows, not on-premises group sensitivity marking and change detection.
- D. Microsoft Defender for Office 365 protects email and collaboration workloads, not on-premises Active Directory group monitoring and alerting.
Question 83
You have a Microsoft Sentinel deployment. You are developing a solution to ensure that compliance with the MITRE ATT&CK framework is maintained as the framework evolves. You need to recommend a solution to identify which MITRE ATT&CK techniques are NOT addressed by the current Microsoft Sentinel deployment. What should you include in the recommendation?
Show answer and explanation
Correct answer: C. the MITRE coverage matrix
Microsoft Sentinel maps its analytics rules to MITRE ATT&CK tactics and techniques and presents the result as a coverage matrix. The matrix shades each technique according to how many active rules and detections cover it, so the techniques with no coverage at all stand out immediately. Because the matrix is rebuilt from the current rule set against the current framework version, it keeps answering the question as the framework evolves, which is the ongoing compliance requirement.
Why the other options are wrong
- A. The Health Summary dashboard reports on the operational health of the Sentinel deployment, such as connector and rule failures, not on which attack techniques are detected.
- B. There is no MITRE analytics explorer in Microsoft Sentinel. The MITRE view is the coverage matrix.
- D. The Analytics blade lists the rules that exist. It does not show which techniques have no rule mapped to them, which is the gap the recommendation must find.
Question 84
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are designing a security strategy for providing access to Azure App Service web apps through an Azure Front Door instance. You need to recommend a solution to ensure that the web apps only allow access through the Front Door instance. Solution: You recommend access restrictions that allow traffic from the Front Door service tags. Does this meet the goal?
Show answer and explanation
Correct answer: B. No
Using Front Door service tags alone does not adequately meet the goal because service tags represent broad IP address ranges used by the Front Door service, but they don't uniquely identify traffic coming from your specific Front Door instance. This approach is overly permissive and could allow unauthorized access from other Front Door instances or services using the same service tags. The requirement is to ensure access only through your specific Front Door instance, which requires identity-based validation such as custom HTTP headers.
Why the other options are wrong
- A. Service tags are too broad and non-specific; they include all Front Door infrastructure IP ranges, not just your instance, failing to provide the required exclusive access restriction.
Question 85
You have a Microsoft 365 subscription and an Azure subscription. Microsoft 365 Defender and Microsoft Defender for Cloud are enabled. The Azure subscription contains 50 virtual machines. Each virtual machine runs different applications on Windows Server 2019. You need to recommend a solution to ensure that only authorized applications can run on the virtual machines. If an unauthorized application attempts to run or be installed, the application must be blocked automatically until an administrator authorizes the application. Which security control should you recommend?
Show answer and explanation
Correct answer: D. adaptive application controls in Defender for Cloud
Adaptive application controls in Defender for Cloud is designed to allow only authorized applications to run on virtual machines. It automatically blocks unauthorized applications and requires administrator approval for new applications before they can execute, meeting both the monitoring and automatic blocking requirements specified.
Why the other options are wrong
- A. App registrations in Azure AD are for managing application identities in the directory, not for controlling which applications can run on physical machines.
- B. Azure AD Conditional Access App Control policies govern access to cloud applications, not local application execution on virtual machines.
- C. App discovery anomaly detection policies identify unusual application behavior but do not enforce application whitelisting or automatic blocking of unauthorized applications.
Question 86
Your company has an Azure subscription that uses Microsoft Defender for Cloud. The company signs a contract with the United States government. You need to review the current subscription for NIST 800-53 compliance. What should you do first?
Show answer and explanation
Correct answer: C. From Defender for Cloud, add a regulatory compliance standard.
Adding a regulatory compliance standard in Defender for Cloud is the first step to review NIST 800-53 compliance. This action enables the compliance dashboard and assessment tools specific to NIST 800-53 requirements.
Why the other options are wrong
- A. Enabling Defender plans provides threat detection capabilities, not compliance standard framework setup.
- B. The Azure security baseline audit report is a review mechanism, not the initial setup for regulatory compliance standards.
- D. Microsoft Defender for Cloud Apps access policies manage cloud application access control, not regulatory compliance standards.
Question 87
You have a Microsoft Entra tenant that syncs with an Active Directory Domain Services (AD DS) domain. You have an on-premises datacenter that contains 100 servers. The servers run Windows Server and are backed up by using Microsoft Azure Backup Server (MABS). You are designing a recovery solution for ransomware attacks. The solution follows Microsoft Security Best Practices. You need to ensure that a compromised local administrator account cannot be used to stop scheduled backups. What should you do?
Show answer and explanation
Correct answer: A. From Azure Backup, configure multi-user authorization by using Resource Guard.
Azure Resource Guard implements multi-user authorization for critical backup operations, ensuring that no single compromised account (including local administrators) can unilaterally stop or delete backups. This requires multiple authorized identities to approve critical operations, directly preventing a compromised local administrator from disabling backup protections and aligns with Microsoft Security Best Practices for ransomware defense.
Why the other options are wrong
- B. PIM manages privileged role assignment activation but does not provide multi-user authorization controls for backup operations themselves.
- C. Registering MABS with a Recovery Services vault is a basic configuration step that doesn't prevent compromised accounts from stopping backups.
- D. A security PIN for critical operations provides basic protection but lacks the multi-user authorization enforcement required to prevent a single compromised account from disabling backups.
Question 88
You have an Azure subscription that is used as an Azure landing zone for an application. You need to evaluate the security posture of all the workloads in the landing zone. What should you do first?
Show answer and explanation
Correct answer: D. Enable the Defender plan for all resource types in Microsoft Defender for Cloud.
Enabling the Defender plan for all resource types in Microsoft Defender for Cloud is the foundational first step to evaluate the security posture of workloads. This enables comprehensive threat protection, vulnerability assessment, and security posture monitoring across all Azure resources in the landing zone.
Why the other options are wrong
- A. CI/CD vulnerability scanning is valuable but comes after establishing baseline security posture monitoring.
- B. Azure AD Premium Plan 2 licenses are for identity security but are not the first priority for workload security posture evaluation.
- C. Microsoft Sentinel data connectors are for log aggregation and SIEM functionality, not for initial security posture assessment.
Question 89
You are designing security for an Azure landing zone. Your company identifies the following compliance and privacy requirements: • Encrypt cardholder data by using encryption keys managed by the company. • Encrypt insurance claim files by using encryption keys hosted on-premises. Which two configurations meet the compliance and privacy requirements? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: B, C. Store the insurance claim data in Azure Blob storage encrypted by using customer-provided keys; Store the cardholder data in an Azure SQL database that is encrypted by using keys stored in Azure Key Vault Managed HSM.
Customer-provided keys let each Blob storage request supply its own encryption key, so the key can be held on-premises and never stored in Azure, which meets the insurance claim requirement. Azure SQL with transparent data encryption using a key in Key Vault Managed HSM gives the company control of the cardholder data keys.
Why the other options are wrong
- A. Microsoft-managed keys are controlled by Microsoft, not by the company.
- D. Managed HSM keys are hosted in Azure rather than on-premises, and Azure Files does not support customer-provided keys.
Question 90
Your company has an office in Seattle. The company has two Azure virtual machine scale sets hosted on different virtual networks. The company plans to contract developers in India. You need to recommend a solution provide the developers with the ability to connect to the virtual machines over SSL from the Azure portal. The solution must meet the following requirements: • Prevent exposing the public IP addresses of the virtual machines. • Provide the ability to connect without using a VPN. • Minimize costs. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, C. Create a hub and spoke network by using virtual network peering; Deploy Azure Bastion to one virtual network.
Azure Bastion deployed to one virtual network provides SSL-based RDP/SSH connections from the Azure portal without exposing public IPs. Creating hub-and-spoke network topology with virtual network peering allows developers to connect through the single Bastion instance to VMs on both networks, providing connectivity across multiple virtual networks while minimizing costs by avoiding Bastion deployment to each network.
Why the other options are wrong
- B. Deploying Azure Bastion to each virtual network is redundant and increases costs unnecessarily when a single Bastion can serve both networks via peering.
- D. NAT and firewall rules would still require public IP exposure or additional complexity; Bastion provides a cleaner solution.
- E. Just-in-time VM access restricts network access but does not provide the SSL-based portal connectivity required by the solution.
That was 90 of 360.
The full Microsoft SC-100 pack has all 360 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 180 free as one PDF by email. Get the Half Pack →