View Full Microsoft SC-100 Exam Dumps and Practice Test Dumps.

 

Question 181

Which Microsoft Entra capability can help organizations manage guest users and their access throughout the collaboration lifecycle?

1. Azure Firewall
2. Microsoft Defender for Endpoint
3. Microsoft Entra External ID
4. Azure Monitor

Correct Answer: 3
Explanation

Microsoft Entra External ID provides capabilities for managing external identities and supporting collaboration with people outside an organization. It can help organizations establish controlled authentication and authorization experiences for external users while maintaining appropriate governance. This is useful when partners, customers, or other external identities need access to selected resources. Azure Firewall and Azure Monitor address networking and monitoring, while Defender for Endpoint focuses on device security. External identity architecture should also include appropriate access reviews, Conditional Access, and least-privilege controls.

Question 182

A security architect wants applications to authenticate to Azure services without storing passwords or client secrets. Which option is most appropriate?

1. Managed identities
2. Shared administrator passwords
3. Hard-coded credentials
4. Public API keys

Correct Answer: 1
Explanation

Managed identities provide applications and Azure resources with an identity that can be used to authenticate to supported services without developers having to store credentials in application code. This reduces the exposure associated with long-lived secrets and simplifies credential management. Shared passwords and hard-coded credentials can be difficult to protect and rotate, while public API keys can be exposed to unauthorized parties. The managed identity should still receive only the permissions required by the workload to maintain least privilege.

Question 183

Which security architecture capability helps determine whether a cloud resource is configured according to organizational security standards?

1. Azure Load Balancer
2. Configuration compliance assessment
3. Azure DNS
4. Microsoft Teams

Correct Answer: 2
Explanation

Configuration compliance assessment evaluates resources against established security baselines, policies, or organizational requirements. It can identify deviations such as insecure network exposure, missing encryption settings, or other configuration weaknesses. This capability supports continuous security posture management because cloud environments can change frequently through deployments and administrative actions. Load Balancer and DNS provide networking functionality, while Teams is a collaboration service. Compliance assessment should be combined with policy governance, monitoring, remediation processes, and change management.

Question 184

Which approach can reduce the likelihood that a compromised endpoint will be able to access privileged administrative resources?

1. Flat network connectivity
2. Shared administrator credentials
3. Privileged access isolation
4. Universal endpoint permissions

Correct Answer: 3
Explanation

Privileged access isolation separates sensitive administrative activities from ordinary endpoint operations. This can include dedicated administrative workstations, separate privileged identities, strong authentication, restricted network paths, and just-in-time elevation. The objective is to reduce opportunities for malware or compromised user sessions to reach highly privileged resources. Flat connectivity and shared credentials increase exposure, while universal permissions provide unnecessary access. Privileged access isolation is especially valuable for protecting accounts that can modify security controls or critical infrastructure.

Question 185

An organization wants to identify unusual sign-in behavior that could indicate account compromise. Which capability should be incorporated into the security architecture?

1. Identity risk detection
2. Resource tagging
3. Storage replication
4. Network load balancing

Correct Answer: 1
Explanation

Identity risk detection can identify suspicious authentication patterns and other signals associated with potentially compromised accounts. Examples may include unusual sign-in characteristics, leaked credentials, or other indicators that increase confidence that an identity requires additional scrutiny. Risk information can then be incorporated into access decisions through appropriate identity policies. Resource tagging and storage replication support governance and resilience, while load balancing addresses traffic distribution. Identity risk detection is particularly useful when combined with strong authentication and Conditional Access.

Question 186

Which Azure architecture component can help provide centralized policy and connectivity services for multiple workload networks?

1. Azure Storage
2. Azure Virtual WAN
3. Azure Key Vault
4. Microsoft Purview

Correct Answer: 2
Explanation

Azure Virtual WAN provides a managed networking architecture that can connect branch locations, virtual networks, and other network environments through a centralized framework. It can support large-scale connectivity and integration with security and routing capabilities. Azure Storage manages data, Key Vault manages secrets and cryptographic keys, and Purview supports data governance. Virtual WAN can be useful when an organization needs consistent connectivity across distributed environments, although the architecture should still address segmentation, traffic inspection, routing, and administrative boundaries.

Question 187

Which security practice helps ensure that software artifacts released to production have not been unexpectedly modified?

1. Artifact integrity verification
2. Public artifact modification
3. Shared deployment credentials
4. Unrestricted build access

Correct Answer: 1
Explanation

Artifact integrity verification helps confirm that software packages, container images, or other deployment artifacts are the expected versions and have not been altered unexpectedly. Techniques such as digital signatures, hashes, trusted registries, and controlled build processes can support this objective. Public modification and unrestricted build access increase supply-chain risk, while shared credentials reduce accountability. Artifact security should be incorporated throughout the software delivery lifecycle, from source control and build processes through storage, deployment, and runtime validation.

Question 188

A company wants to limit administrative permissions so that database administrators cannot automatically modify unrelated network security configurations. Which principle should be applied?

1. Implicit trust
2. Least privilege
3. Universal administration
4. Shared authorization

Correct Answer: 2
Explanation

Least privilege ensures that users and administrators receive only the permissions required to perform their assigned responsibilities. Separating database administration from unrelated network security permissions reduces the potential impact of compromised or misused administrative accounts. Universal administration provides excessive privileges and increases the blast radius of a security incident. Shared authorization can also weaken accountability. Least privilege should be implemented through appropriately scoped roles, separate administrative responsibilities, periodic access reviews, and temporary elevation when higher privileges are genuinely required.

Question 189

Which Microsoft security capability can help detect suspicious activity involving identities in a hybrid Active Directory environment?

1. Microsoft Defender for Identity
2. Azure Load Balancer
3. Microsoft Purview
4. Azure Storage

Correct Answer: 1
Explanation

Microsoft Defender for Identity is designed to help protect identity infrastructure by analyzing signals associated with on-premises Active Directory environments. It can identify suspicious activities involving domain controllers, credentials, accounts, and authentication behavior. This is particularly valuable for organizations operating hybrid environments where on-premises identity systems remain connected to cloud services. Load Balancer and Storage provide infrastructure capabilities, while Purview focuses on data governance and compliance. Defender for Identity can contribute important identity telemetry to a broader detection and response architecture.

Question 190

Which design approach provides stronger isolation between development, testing, and production environments?

1. Shared unrestricted resources
2. Separate environments with controlled access
3. Common administrative credentials
4. Direct production modification

Correct Answer: 2
Explanation

Separating development, testing, and production environments reduces the likelihood that mistakes, compromised development systems, or unauthorized changes will directly affect production workloads. Each environment can have distinct identities, permissions, network boundaries, policies, and deployment processes. Shared unrestricted resources and common administrative credentials weaken these boundaries. Direct production modification also bypasses controlled deployment processes. Environment separation should be supported by CI/CD controls, access governance, monitoring, and approval workflows appropriate to the sensitivity of production resources.

Question 191

Which security architecture capability helps identify relationships between users, devices, applications, and security events during an investigation?

1. Security analytics and entity correlation
2. Storage replication
3. Resource locking
4. DNS forwarding

Correct Answer: 1
Explanation

Security analytics and entity correlation connect events with related users, devices, applications, IP addresses, and other entities to provide broader investigation context. This can help analysts understand whether apparently separate activities are part of the same attack sequence. Security information and event management platforms can perform this type of correlation using collected telemetry. Storage replication, resource locks, and DNS forwarding serve other infrastructure purposes. Entity correlation is valuable for improving investigation quality and identifying complex attacks that cross multiple security domains.

Question 192

A security architect wants to protect a critical workload from accidental exposure caused by configuration changes. Which combination is most appropriate?

1. Open permissions and public endpoints
2. Policy enforcement and configuration monitoring
3. Shared credentials and unrestricted administration
4. Disabled logging and manual changes

Correct Answer: 2
Explanation

Policy enforcement can prevent or flag configurations that violate organizational requirements, while configuration monitoring can detect changes that occur after deployment. Together, these controls reduce the likelihood that accidental or unauthorized changes will leave a critical workload exposed. Public endpoints and open permissions can increase risk, while shared credentials weaken accountability. Disabled logging also makes investigation more difficult. Critical workloads should use layered governance that includes policy, identity controls, monitoring, change management, and regular security assessment.

Question 193

Which approach can help protect sensitive applications from unauthorized access originating from unmanaged devices?

1. Device-based access controls
2. Permanent anonymous access
3. Shared application passwords
4. Universal device permissions

Correct Answer: 1
Explanation

Device-based access controls can evaluate whether a device meets defined security or management requirements before permitting access to sensitive applications. Organizations can use device compliance information and Conditional Access policies to restrict or challenge access from unmanaged or noncompliant devices. Shared passwords and anonymous access provide weak protection, while universal device permissions do not account for device security state. Device-based controls are most effective when combined with identity verification, strong authentication, application-specific authorization, and continuous monitoring.

Question 194

Which security architecture practice helps an organization identify whether its current controls satisfy a defined target security state?

1. Security gap analysis
2. Public network exposure
3. Password sharing
4. Uncontrolled configuration changes

Correct Answer: 1
Explanation

Security gap analysis compares the current security environment with a defined target state to identify missing controls, weaknesses, process deficiencies, or architectural differences. The findings can then be prioritized according to business risk and used to develop a security roadmap. Public exposure and uncontrolled changes can create risks but do not provide a structured method for measuring the gap between current and desired security states. A useful gap analysis should consider technology, identity, data, network, governance, operations, and compliance requirements.

Question 195

Which architecture approach helps ensure that security controls are applied consistently when applications are deployed repeatedly through automation?

1. Security as code
2. Manual configuration only
3. Shared administrator accounts
4. Uncontrolled production changes

Correct Answer: 1
Explanation

Security as code represents security requirements through automated policies, configurations, tests, or deployment controls that can be consistently applied during infrastructure and application delivery. This reduces dependence on manual configuration and helps organizations repeat approved security patterns across environments. Manual-only configuration can produce inconsistent results, while shared administrator accounts reduce accountability. Security as code can include policy checks, infrastructure scanning, secure configuration templates, and automated validation within CI/CD pipelines. It should complement runtime monitoring and governance rather than replace them.

Question 196

Which security architecture capability can help an organization discover and manage applications that employees use without formal approval?

1. Cloud application discovery
2. Azure Backup
3. Azure Bastion
4. Azure Resource Locks

Correct Answer: 1
Explanation

Cloud application discovery helps organizations identify applications being used within their environment, including applications that may not have gone through formal security review. Understanding this usage can help security teams assess application risk, data exposure, compliance implications, and appropriate governance requirements. Azure Backup focuses on recovery, Bastion provides secure administrative connectivity, and Resource Locks protect resources from certain changes. Cloud application discovery is useful for addressing shadow IT and improving visibility into the organization’s actual application landscape.

Question 197

Which control can help prevent a user from downloading sensitive information when the activity violates organizational policy?

1. Data Loss Prevention
2. Azure Load Balancer
3. Azure VPN Gateway
4. Azure Traffic Manager

Correct Answer: 1
Explanation

Data Loss Prevention policies can identify sensitive information and apply actions when users attempt activities that violate organizational data protection requirements. Depending on the supported workload and configuration, DLP can provide warnings, restrictions, or other policy-driven responses. Load Balancer, VPN Gateway, and Traffic Manager address networking and traffic management rather than sensitive-data handling. DLP should be based on classification and business requirements, and organizations should monitor policy effectiveness to ensure protection does not unnecessarily interfere with legitimate workflows.

Question 198

Which security architecture strategy is most appropriate for a service that must recover quickly after a destructive cyberattack?

1. Cyber recovery with isolated and protected backups
2. Single copy of production data
3. Publicly writable backups
4. Shared backup credentials

Correct Answer: 1
Explanation

Cyber recovery architecture should protect recovery resources from the same attack that affects production. Isolated and protected backups can reduce the likelihood that attackers will alter or destroy recovery data after compromising production systems. Depending on requirements, the design may include immutable storage, separate administrative identities, restricted connectivity, monitoring, and regularly tested recovery procedures. A single production copy or publicly writable backup provides poor resilience. Shared backup credentials also increase the risk that compromise of one account could affect recovery resources.

Question 199

Which governance mechanism allows an organization to establish security requirements while providing a documented process for handling legitimate exceptions?

1. Security policy and exception management
2. Unrestricted administrative access
3. Anonymous configuration changes
4. Public resource permissions

Correct Answer: 1
Explanation

Security policy defines the expected security requirements, while exception management provides a controlled process for situations where those requirements cannot immediately be met. A formal exception should document the affected system, business justification, risk, compensating controls, owner, approval, and review or expiration date. This prevents temporary deviations from becoming unmanaged permanent weaknesses. Unrestricted access and public permissions increase exposure rather than governing exceptions. Effective governance balances consistent security requirements with documented business and technical realities.

Question 200

A security architect is creating a long-term security roadmap. Which factor should receive priority when deciding which initiatives to implement first?

1. Vendor popularity
2. Risk reduction and business impact
3. Number of available products
4. Preference for newer technology

Correct Answer: 2
Explanation

Security roadmaps should prioritize initiatives according to risk reduction, business impact, regulatory requirements, dependencies, and implementation feasibility. A control that significantly reduces a critical business risk may deserve earlier attention than a technology initiative simply because it is newer or more popular. Focusing on vendor popularity or the number of available products does not establish whether an initiative addresses an important organizational need. A risk-based roadmap provides a structured way to sequence security improvements while aligning architecture investments with business objectives.