View Full Microsoft SC-100 Exam Dumps and Practice Test Dumps.

 

Question 221

Which Microsoft Entra capability can require users to complete an approval process before receiving access to a collection of organizational resources?

1. Microsoft Entra Entitlement Management
2. Azure Firewall
3. Microsoft Defender for Endpoint
4. Azure Monitor

Correct Answer: 1
Explanation

Microsoft Entra Entitlement Management can use access packages and associated policies to manage how users request and receive access to groups of resources. Organizations can configure approval requirements, expiration periods, and other conditions before access is granted. This provides a structured approach to managing access for employees, guests, and other identities. Azure Firewall focuses on network security, Defender for Endpoint protects devices, and Azure Monitor provides monitoring capabilities. Entitlement management supports identity governance by making resource access more controlled and reviewable.

Question 222

Which architecture approach helps protect an application from a compromised database credential by limiting what the credential can access?

1. Shared database administration
2. Broad permissions
3. Scoped database authorization
4. Universal database access

Correct Answer: 3
Explanation

Scoped database authorization limits a credential to the specific databases, schemas, tables, or operations required by the application. If that credential is compromised, the attacker has fewer opportunities to access unrelated information or perform unauthorized operations. Shared administration and broad permissions increase the potential blast radius, while universal access removes useful security boundaries. Database access should be designed according to application requirements and should include strong identity controls, secret management, auditing, encryption, and periodic permission reviews.

Question 223

Which Microsoft security capability provides protection against threats targeting cloud applications and can help identify risky application usage?

1. Microsoft Defender for Cloud Apps
2. Microsoft Entra Lifecycle Workflows
3. Azure Resource Locks
4. Azure DNS

Correct Answer: 1
Explanation

Microsoft Defender for Cloud Apps provides capabilities for discovering, monitoring, and securing cloud application usage. It can help organizations identify risky applications, assess activity, and apply security controls to supported cloud services. Lifecycle Workflows automate identity lifecycle processes, Resource Locks protect Azure resources from certain administrative changes, and DNS provides name resolution. Cloud application security is important because employees may use many SaaS services, and security teams need visibility into how applications interact with organizational identities and data.

Question 224

A security architect wants to ensure that privileged access is automatically removed after an approved period. Which design should be used?

1. Permanent role assignment
2. Time-bound privileged access
3. Shared administrator account
4. Universal permissions

Correct Answer: 2
Explanation

Time-bound privileged access automatically limits elevated permissions to a defined period, reducing the amount of time an administrator can use powerful privileges. This supports just-in-time access and reduces standing privilege. Permanent assignments leave sensitive permissions available for longer periods and can increase the consequences of credential compromise. Shared administrator accounts also weaken accountability. Time-bound access should be combined with strong authentication, approval requirements, monitoring, auditing, and periodic review to provide effective privileged identity governance.

Question 225

Which security architecture capability can help identify whether an endpoint meets required security conditions before granting application access?

1. Device compliance evaluation
2. Public DNS
3. Storage replication
4. Load balancing

Correct Answer: 1
Explanation

Device compliance evaluation determines whether an endpoint meets defined security requirements, such as encryption, security software, configuration standards, or management status. This information can be used by access policies to determine whether a device should be permitted to access sensitive applications. Public DNS, storage replication, and load balancing address networking or availability rather than endpoint security state. Device compliance is most effective when integrated with identity verification, Conditional Access, endpoint management, and risk-based access policies.

Question 226

Which security architecture principle requires an organization to continuously evaluate access instead of assuming that previously approved access remains safe?

1. Implicit trust
2. Continuous verification
3. Permanent authorization
4. Network perimeter trust

Correct Answer: 2
Explanation

Continuous verification means access decisions should account for changing identity, device, application, and risk conditions rather than relying indefinitely on an earlier authorization decision. This principle aligns with Zero Trust because authentication or previous approval does not automatically guarantee that access remains appropriate. Implicit and perimeter-based trust can allow access to continue without sufficient reassessment. Continuous verification can be supported through Conditional Access, risk detection, device compliance, monitoring, and periodic access reviews.

Question 227

Which Azure service can help protect an application against volumetric denial-of-service attacks at the network level?

1. Azure Key Vault
2. Azure DDoS Protection
3. Azure Policy
4. Azure Storage

Correct Answer: 2
Explanation

Azure DDoS Protection is designed to help defend supported Azure resources against distributed denial-of-service attacks. It can detect and mitigate certain attack traffic while helping maintain availability. Key Vault protects secrets and cryptographic keys, Policy provides governance, and Storage provides data services. DDoS protection should be considered as one layer within a broader resilience architecture that includes high availability, traffic management, monitoring, capacity planning, application security, and tested recovery procedures.

Question 228

Which practice helps ensure that a cloud application does not retain permissions after its business purpose has ended?

1. Identity deprovisioning
2. Permanent role assignments
3. Shared service accounts
4. Unrestricted access

Correct Answer: 1
Explanation

Identity deprovisioning removes or disables identities and permissions when they are no longer required. This is important for users, applications, service accounts, and other workload identities because unused permissions can become security liabilities. Permanent role assignments and shared accounts make it harder to maintain accurate access control, while unrestricted access increases exposure. Deprovisioning should be integrated with identity lifecycle processes, ownership records, access reviews, automated workflows, and appropriate logging so that access is removed promptly when business requirements change.

Question 229

Which Microsoft security solution can correlate endpoint, identity, email, and application signals to help identify coordinated attacks?

1. Microsoft Defender XDR
2. Microsoft Purview
3. Azure Resource Manager
4. Microsoft Intune

Correct Answer: 1
Explanation

Microsoft Defender XDR correlates security signals across supported Microsoft security products to provide a broader view of related attack activity. This can help security teams connect events involving endpoints, identities, email, applications, and other security domains. Purview focuses on data governance and compliance, Azure Resource Manager manages Azure resources, and Intune provides device and application management. Cross-domain correlation is useful because sophisticated attacks often involve multiple systems, and isolated alerts may not reveal the complete attack sequence.

Question 230

An organization wants to ensure that security requirements are considered before a cloud migration begins. What should the architecture team perform?

1. Security architecture assessment
2. Immediate workload migration
3. Credential sharing
4. Policy removal

Correct Answer: 1
Explanation

A security architecture assessment evaluates workloads, identities, data, dependencies, network connectivity, compliance obligations, and security requirements before migration. Performing this work early helps identify risks and determine appropriate controls before production workloads are moved. Immediate migration can transfer existing weaknesses into a new environment, while credential sharing and policy removal increase exposure. The assessment should result in documented security requirements, architectural decisions, migration risks, and appropriate controls for the target cloud environment.

Question 231

Which architecture approach helps reduce the impact of a compromised application by separating its network traffic from unrelated workloads?

1. Network segmentation
2. Flat networking
3. Universal routing
4. Public connectivity

Correct Answer: 1
Explanation

Network segmentation creates boundaries between workloads and restricts communication to approved paths. If one application becomes compromised, segmentation can reduce the attacker’s ability to move directly into unrelated systems. Flat networking and universal routing provide broader connectivity and can increase lateral movement opportunities. Public connectivity may also increase exposure depending on the workload. Segmentation should be based on application dependencies, trust boundaries, data sensitivity, and business requirements and should be enforced through appropriate network security controls.

Question 232

Which Microsoft Sentinel feature is primarily used to visualize security information and operational trends through dashboards?

1. Analytics rules
2. Playbooks
3. Workbooks
4. Data connectors

Correct Answer: 3
Explanation

Microsoft Sentinel workbooks provide interactive visualizations and dashboards for security data. They can display trends, incidents, metrics, and other information to help analysts and security leaders understand the security environment. Analytics rules detect potentially suspicious activity, playbooks automate response actions, and data connectors ingest information from supported sources. Workbooks are useful for operational monitoring and reporting, although their effectiveness depends on the quality and completeness of the underlying security data.

Question 233

Which control can help ensure that security-sensitive changes to production infrastructure are traceable to an identified administrator?

1. Individual administrative identities
2. Shared administrator credentials
3. Anonymous access
4. Generic passwords

Correct Answer: 1
Explanation

Individual administrative identities provide accountability by associating security-sensitive actions with specific users. This allows organizations to determine who performed a change and supports auditing, investigation, and governance. Shared administrator accounts and generic passwords weaken attribution because multiple people may use the same credentials. Anonymous access eliminates identity information altogether. Administrative identities should be protected with strong authentication, least privilege, privileged access controls, logging, and periodic review. Clear attribution is especially important for critical infrastructure and security configuration changes.

Question 234

Which architecture capability can help ensure that sensitive data is encrypted while moving between applications and services?

1. Encryption in transit
2. Plaintext communication
3. Shared network passwords
4. Public file permissions

Correct Answer: 1
Explanation

Encryption in transit protects data while it moves between clients, applications, services, and other endpoints. Secure protocols such as TLS can help prevent unauthorized parties from reading or modifying transmitted information. Plaintext communication exposes sensitive information to interception, while shared passwords and public permissions address different security concerns. Encryption in transit should be combined with encryption at rest, strong identity controls, certificate management, secure network architecture, and appropriate authorization to provide comprehensive data protection.

Question 235

A company wants to ensure that a critical application can survive the failure of an individual availability zone. Which design should be considered?

1. Multi-zone deployment
2. Single-instance deployment
3. Single-zone dependency
4. One-server architecture

Correct Answer: 1
Explanation

A multi-zone deployment places application components across separate availability zones so that a failure affecting one zone does not necessarily make the entire application unavailable. This design can improve resilience for workloads that require higher availability. A single-instance or single-zone architecture creates a larger dependency on one infrastructure location. Multi-zone designs should consider application state, data replication, load balancing, dependencies, failover behavior, monitoring, and recovery procedures to ensure that the architecture actually meets the required availability objectives.

Question 236

Which security architecture capability helps identify whether a user has accumulated unnecessary permissions across multiple applications?

1. Identity governance
2. Network address translation
3. Traffic management
4. Storage replication

Correct Answer: 4
Explanation

Identity governance provides processes and capabilities for managing access throughout the identity lifecycle. It can help identify excessive permissions through access reviews, entitlement management, lifecycle processes, and role governance. This reduces the risk of privilege accumulation when users change responsibilities or gain access to additional applications over time. Network address translation and traffic management address connectivity, while storage replication supports resilience. Identity governance should be aligned with business roles, resource sensitivity, approval processes, and least-privilege requirements.

Question 237

Which approach can help detect unauthorized modifications to critical configuration files or security policies?

1. Integrity monitoring
2. Public write access
3. Shared administrator accounts
4. Disabled auditing

Correct Answer: 1
Explanation

Integrity monitoring can detect unexpected changes to protected files, configurations, or other security-sensitive resources. This can help security teams identify unauthorized modifications that may indicate compromise, malicious activity, or accidental configuration changes. Public write access increases the likelihood of unauthorized changes, while shared accounts reduce accountability. Disabled auditing also makes investigation more difficult. Integrity monitoring should be combined with access controls, centralized logging, change management, configuration baselines, and alerting to provide effective protection.

Question 238

Which security architecture practice helps organizations determine whether a security control actually reduces the intended risk after implementation?

1. Control effectiveness testing
2. Control removal
3. Unrestricted access
4. Disabled monitoring

Correct Answer: 1
Explanation

Control effectiveness testing evaluates whether a security control operates as intended and reduces the risk it was designed to address. Testing may include technical validation, configuration checks, simulated scenarios, audit reviews, or analysis of security metrics. Simply deploying a control does not guarantee that it is effective. Removing controls or disabling monitoring reduces assurance, while unrestricted access may undermine the control’s purpose. Effectiveness testing should be repeated when systems, threats, or business requirements change significantly.

Question 239

Which Microsoft service can help protect identities by detecting risky users and sign-ins and providing signals for access decisions?

1. Microsoft Entra ID Protection
2. Azure Load Balancer
3. Azure Storage
4. Microsoft Purview

Correct Answer: 1
Explanation

Microsoft Entra ID Protection provides identity risk detection capabilities that can identify potentially compromised users and risky sign-in activity. These risk signals can be incorporated into Conditional Access policies to require additional authentication or block access when appropriate. Load Balancer and Storage provide infrastructure services, while Purview focuses on data governance and compliance. Identity risk detection is particularly valuable in Zero Trust architectures because access decisions can consider the security risk associated with an authentication event rather than relying only on a valid credential.

Question 240

A security architect wants to establish reusable security configurations for multiple cloud workloads. Which approach is most appropriate?

1. Security baselines and architecture patterns
2. Independent manual configuration for every workload
3. Shared administrator passwords
4. Uncontrolled production changes

Correct Answer: 3
Explanation

Security baselines and reusable architecture patterns provide predefined configurations and design practices that can be applied consistently across workloads. They help reduce configuration drift, accelerate secure deployments, and establish a common security standard. Manual configuration for every workload can produce inconsistencies and increase operational effort. Shared passwords and uncontrolled production changes create additional security risks. Baselines should still allow documented exceptions where justified and should be regularly reviewed to ensure that they remain aligned with current threats, technologies, and organizational requirements.