View Full Microsoft SC-100 Exam Dumps and Practice Test Dumps.

 

Question 301

Which Microsoft security architecture capability helps correlate security signals from identities, endpoints, email, and applications to investigate an attack across multiple surfaces?

1. Microsoft Defender XDR
2. Azure Cost Management
3. Azure Resource Manager
4. Microsoft Purview Records Management

Correct Answer: 1
Explanation

Microsoft Defender XDR correlates security signals across multiple Microsoft security products to provide a broader view of attacks and related entities. This can help security teams investigate incidents that span identities, endpoints, email, applications, and other supported resources. Cost Management focuses on financial analysis, Resource Manager manages Azure resources, and Records Management addresses information governance. Cross-domain correlation is valuable because attackers often move between security surfaces rather than remaining within a single technology layer.

Question 302

An organization needs to ensure that development workloads cannot access production secrets even though both environments use the same cloud platform. Which architecture should be used?

1. Shared credentials across environments
2. Separate identities and access boundaries
3. Global administrator permissions
4. Common unrestricted secret store

Correct Answer: 2
Explanation

Separate identities and access boundaries help prevent development workloads from accessing production resources and secrets. Development, testing, and production environments should have clearly defined trust boundaries, permissions, and administrative controls. Sharing credentials across environments increases the impact of compromise and makes accountability difficult. Global administrator permissions and unrestricted secret stores create excessive privilege. Environment separation should also include distinct deployment pipelines, access policies, monitoring, and approval processes so that production resources remain protected from lower-trust environments.

Question 303

Which Microsoft security capability is designed to help discover and govern sensitive data across an organization’s data estate?

1. Azure Bastion
2. Azure Firewall
3. Microsoft Purview
4. Azure Traffic Manager

Correct Answer: 3
Explanation

Microsoft Purview provides data governance and compliance capabilities that can help organizations discover, classify, govern, and protect information across supported data sources. Understanding where sensitive information exists is an important architectural requirement because security controls depend on knowing which data requires stronger protection. Azure Bastion provides administrative access, Azure Firewall provides network security, and Traffic Manager provides traffic routing. Purview capabilities can support data classification, governance, compliance, lifecycle management, and protection decisions across an organization’s information environment.

Question 304

Which approach provides a dedicated security boundary for high-value administrative accounts and systems?

1. Public administration network
2. Shared workstation model
3. Standard user environment
4. Privileged administrative tiering

Correct Answer: 4
Explanation

Privileged administrative tiering separates highly privileged systems and accounts from lower-trust environments. This limits pathways through which an attacker compromising an ordinary workstation or account could reach critical administrative infrastructure. A public administration network or shared workstation model does not provide adequate separation, while a standard user environment is not designed for highly privileged operations. Tiered administration should be supported by dedicated administrative identities, hardened workstations, strong authentication, monitoring, restricted connectivity, and clearly defined administrative procedures.

Question 305

Which security control is most appropriate for preventing unauthorized users from changing critical Azure resource configurations?

1. Role-based access control
2. Public network access
3. Anonymous authentication
4. Unrestricted contributor access

Correct Answer: 1
Explanation

Role-based access control helps limit Azure resource management operations according to assigned roles and permissions. By granting users only the permissions required for their responsibilities, organizations can reduce unauthorized configuration changes. Public network access does not determine administrative authorization, while anonymous authentication and unrestricted contributor access provide insufficient protection. RBAC should be combined with privileged identity management, strong authentication, access reviews, logging, and separation of duties for sensitive administrative operations.

Question 306

Which security architecture practice helps determine whether an organization has sufficient telemetry to investigate a particular threat scenario?

1. Cost optimization
2. Detection coverage assessment
3. Storage expansion
4. Network bandwidth planning

Correct Answer: 2
Explanation

Detection coverage assessment evaluates whether the organization collects and analyzes the signals necessary to identify and investigate relevant threats. It can reveal gaps such as missing endpoint telemetry, insufficient identity logs, unavailable application events, or incomplete cloud activity data. Cost optimization and bandwidth planning may influence architecture decisions but do not directly establish detection coverage. A security architecture should map important threat scenarios to required data sources, detection logic, investigation capabilities, retention requirements, and response procedures.

Question 307

Which Microsoft Sentinel feature can help analysts investigate entities and relationships associated with a security incident?

1. Azure Policy
2. Microsoft Purview
3. Sentinel investigation capabilities
4. Azure Resource Locks

Correct Answer: 3
Explanation

Microsoft Sentinel provides investigation capabilities that help analysts examine incidents, entities, alerts, and related security information. Understanding relationships between users, devices, IP addresses, applications, and other entities can help analysts determine the scope and potential progression of an attack. Azure Policy governs resource configurations, Purview focuses on data governance and compliance, and Resource Locks protect resources from certain changes. Investigation capabilities are most effective when Sentinel receives relevant, high-quality telemetry from appropriately selected data sources.

Question 308

Which architecture pattern is most appropriate when multiple applications require a common security service such as centralized authentication or policy enforcement?

1. Duplicate independent security implementations
2. Shared centralized security service
3. Public anonymous service
4. Uncontrolled application-specific access

Correct Answer: 2
Explanation

A shared centralized security service can provide consistent capabilities across multiple applications while reducing duplicated implementations. Examples include centralized identity services, policy enforcement, key management, logging, or security monitoring. Independent implementations can create inconsistent controls and increase maintenance requirements. Anonymous or uncontrolled access weakens security boundaries. Centralized services should still support appropriate isolation, availability, least privilege, scalability, and clear ownership so that a shared service does not become an unnecessary single point of failure or excessive trust boundary.

Question 309

Which security architecture principle requires sensitive operations to be approved by a different individual from the person performing them?

1. Separation of duties
2. Public access
3. Network openness
4. Shared responsibility without ownership

Correct Answer: 1
Explanation

Separation of duties divides sensitive responsibilities among multiple individuals or roles so that one person cannot independently complete a high-risk process. For example, one administrator may request a privileged change while another authorized person approves it. This reduces the opportunity for unauthorized actions and provides stronger accountability. Public access and network openness do not provide this governance control. Separation of duties should be applied according to risk, especially for activities such as privileged access, security policy changes, production deployments, and financial or regulatory operations.

Question 310

Which Azure architecture component can centralize management of subscriptions and apply governance consistently across multiple workloads?

1. Azure Bastion
2. Azure Management Groups
3. Azure Load Balancer
4. Azure Key Vault

Correct Answer: 2
Explanation

Azure Management Groups provide a hierarchical structure for organizing subscriptions and applying governance at an appropriate scope. Policies, role assignments, and other governance mechanisms can be managed across groups of subscriptions rather than configured independently for every subscription. Bastion provides secure administrative access, Load Balancer distributes traffic, and Key Vault manages secrets and keys. Management groups are useful in large environments where centralized governance and delegated administration must coexist with workload-specific responsibilities.

Question 311

Which security architecture approach helps ensure that cloud resources are created according to a predefined set of organizational security requirements?

1. Manual configuration after deployment
2. Unrestricted resource creation
3. Policy-based governance
4. Public deployment permissions

Correct Answer: 3
Explanation

Policy-based governance allows organizations to define requirements that can be evaluated or enforced during resource deployment and ongoing operation. Policies can address areas such as permitted regions, required configurations, tagging, security settings, and other organizational standards. Manual post-deployment configuration can leave temporary security gaps, while unrestricted creation makes consistent governance difficult. Policy-based controls should be supported by monitoring, exception management, change control, and periodic review so that requirements remain aligned with business and security needs.

Question 312

Which authentication architecture is designed to remove the need for users to regularly enter passwords while using strong cryptographic credentials?

1. Passwordless authentication
2. Shared password authentication
3. Basic authentication
4. Password rotation only

Correct Answer: 1
Explanation

Passwordless authentication allows users to authenticate without relying on traditional passwords as the primary authentication factor. Supported methods can use cryptographic credentials or device-based authentication mechanisms, reducing exposure to password theft, reuse, and phishing. Shared passwords and basic authentication provide weaker protection, while password rotation still depends on passwords. A passwordless architecture should consider device registration, recovery procedures, identity protection, authentication strength, user experience, and application compatibility to ensure that the stronger authentication model can be adopted securely.

Question 313

Which security architecture capability can help determine whether a user should receive access based on the risk level of the sign-in?

1. Azure Storage
2. Azure DNS
3. Risk-based Conditional Access
4. Azure Load Balancer

Correct Answer: 3
Explanation

Risk-based Conditional Access can use identity risk and sign-in risk information to apply appropriate access requirements. Depending on the detected risk and configured policies, an organization can require stronger authentication, block access, or require remediation. Azure Storage, DNS, and Load Balancer provide infrastructure capabilities rather than identity risk evaluation. Risk-based access should be carefully designed to balance security and usability, with appropriate authentication methods, policy exclusions, monitoring, and procedures for handling false positives or legitimate high-risk situations.

Question 314

Which software development security control can detect credentials accidentally committed into source-code repositories?

1. Secret scanning
2. Network load balancing
3. DNS filtering
4. Storage replication

Correct Answer: 1
Explanation

Secret scanning examines source code and related repositories for credentials, tokens, keys, and other sensitive values that may have been accidentally exposed. Detecting secrets early can allow developers and security teams to revoke compromised credentials and prevent them from reaching production systems. Load balancing and DNS filtering address network concerns, while storage replication supports resilience. Secret scanning should be combined with secure secret management, automated credential rotation, developer education, repository controls, and pipeline enforcement so that discovered secrets are handled promptly.

Question 315

Which architecture capability helps an organization identify whether an application has an excessive number of permissions compared with its actual business requirements?

1. Network packet inspection
2. Application authorization review
3. DNS monitoring
4. Storage performance testing

Correct Answer: 2
Explanation

An application authorization review evaluates whether an application or workload has more permissions than necessary for its intended functions. Excessive permissions can increase the impact of compromised applications or identities. Reviewing permissions against documented business requirements helps identify opportunities to reduce privileges and improve authorization boundaries. Network inspection, DNS monitoring, and storage performance testing address different concerns. Authorization reviews should consider application roles, service identities, resource scopes, privileged operations, and changes introduced during application development or deployment.

Question 316

Which security architecture capability can help reduce the impact of a compromised administrator by requiring privileged access to be activated only when needed?

1. Permanent administrator access
2. Shared administrator credentials
3. Just-in-time privileged access
4. Anonymous administration

Correct Answer: 3
Explanation

Just-in-time privileged access limits elevated permissions to a defined period rather than keeping them permanently active. This reduces standing privilege and can limit the time available for attackers to misuse compromised administrative credentials. Permanent access and shared credentials increase exposure, while anonymous administration eliminates appropriate accountability. Just-in-time access should be combined with strong authentication, approval or justification requirements where appropriate, logging, monitoring, and periodic review to ensure that privileged access remains aligned with administrative responsibilities.

Question 317

Which architecture approach can help ensure that security requirements are automatically included when infrastructure is deployed through code?

1. Security as code
2. Manual configuration only
3. Post-deployment inspection only
4. Unrestricted infrastructure deployment

Correct Answer: 1
Explanation

Security as code expresses security requirements through machine-readable configurations, policies, tests, and automated checks that can be integrated into infrastructure and deployment processes. This approach can improve consistency and allow security controls to be evaluated repeatedly as infrastructure changes. Manual configuration alone can introduce inconsistency, while post-deployment inspection may identify issues after exposure has already occurred. Security as code should include version control, peer review, automated validation, controlled deployment, exception handling, and continuous monitoring of the resulting environment.

Question 318

Which security architecture approach is most appropriate for protecting an application that processes highly sensitive information while still allowing required business connectivity?

1. Remove all monitoring
2. Use layered security controls
3. Provide unrestricted network access
4. Rely only on passwords

Correct Answer: 2
Explanation

Layered security controls provide multiple complementary protections around a sensitive application. These can include strong authentication, least privilege, network segmentation, encryption, application authorization, endpoint protection, monitoring, vulnerability management, and incident-response capabilities. Relying on a single control creates a larger impact if that control fails or is bypassed. Unrestricted access and password-only authentication provide insufficient protection for highly sensitive workloads. The architecture should be based on the application’s data sensitivity, business criticality, threat exposure, regulatory obligations, and required connectivity.

Question 319

Which recovery architecture feature prevents backup data from being modified or deleted during a defined protection period?

1. Immutable backup storage
2. Public storage permissions
3. Shared backup credentials
4. Unrestricted administrator access

Correct Answer: 1
Explanation

Immutable backup storage can prevent protected backup data from being modified or deleted during a defined retention or protection period. This can be particularly important in ransomware scenarios where attackers attempt to destroy recovery resources after compromising production systems. Public permissions and shared credentials increase the risk of unauthorized access, while unrestricted administrator access can undermine recovery protections. Immutable backups should be combined with isolated administration, monitoring, recovery testing, appropriate retention requirements, and documented procedures for restoring critical business services.

Question 320

Which security architecture activity should occur when a major business application introduces a significant new data-processing capability?

1. Ignore the change until an incident occurs
2. Remove existing security controls
3. Reassess security and privacy requirements
4. Grant all application users administrative access

Correct Answer: 3
Explanation

A major change in how an application processes data can introduce new security, privacy, compliance, and operational risks. Reassessing requirements allows architects to determine whether existing controls remain appropriate and whether additional protections are needed. The assessment may cover data classification, access permissions, encryption, retention, monitoring, regulatory obligations, third-party dependencies, and threat scenarios. Ignoring the change or removing controls can create unmanaged exposure, while granting broad administrative access violates least-privilege principles. Security architecture should evolve as business capabilities and data usage change.