View Full Microsoft SC-100 Exam Dumps and Practice Test Dumps.

 

Question 121

Which Microsoft Entra capability allows an organization to manage the lifecycle of users and automate identity-related processes?

1. Microsoft Defender for Cloud
2. Microsoft Entra Lifecycle Workflows
3. Azure Firewall
4. Microsoft Sentinel

Correct Answer: 2
Explanation

Microsoft Entra Lifecycle Workflows helps automate identity lifecycle processes such as onboarding, role changes, and offboarding. Automating these activities can reduce delays and help ensure that access is adjusted when a user’s organizational status changes. This is particularly important for preventing former employees or users with changed responsibilities from retaining unnecessary permissions. Defender for Cloud focuses on cloud security, Azure Firewall controls network traffic, and Sentinel provides security analytics. Lifecycle automation supports stronger identity governance and reduces manual administrative errors.

Question 122

An organization wants to protect highly privileged administrative accounts from compromised everyday workstations. Which architecture should the security architect consider?

1. Privileged Access Workstations
2. Shared administrator desktops
3. Public kiosks
4. Unmanaged personal devices

Correct Answer: 1
Explanation

Privileged Access Workstations are dedicated or specially secured devices designed for sensitive administrative activities. Separating privileged operations from everyday browsing, email, and general-purpose work reduces the opportunities for malware or phishing attacks to compromise administrative credentials. Shared desktops and unmanaged personal devices provide weaker control over the security environment. A privileged access workstation strategy can be combined with strong authentication, just-in-time access, endpoint protection, and strict administrative policies to create a hardened privileged access architecture.

Question 123

Which Microsoft Entra feature can control whether users from another organization are allowed to collaborate with users in your tenant?

1. Azure Backup
2. Microsoft Purview
3. Cross-tenant access settings
4. Azure Storage Explorer

Correct Answer: 3
Explanation

Cross-tenant access settings provide controls for managing collaboration and access relationships between Microsoft Entra tenants. Organizations can establish policies governing inbound and outbound access with external tenants and can apply trust settings where appropriate. This is useful for controlling business-to-business collaboration while maintaining organizational security requirements. Azure Backup and Storage Explorer serve different purposes, while Microsoft Purview focuses on data governance and compliance. Cross-tenant governance is particularly important when organizations regularly collaborate with external companies.

Question 124

A security architect wants to ensure that a compromised application cannot automatically access every database in the environment. Which design principle should be applied?

1. Broad application permissions
2. Workload isolation and least privilege
3. Shared database accounts
4. Flat resource access

Correct Answer: 2
Explanation

Workload isolation and least privilege limit an application’s access to only the resources required for its intended function. If an application is compromised, these restrictions can reduce the number of databases and services that an attacker can reach. Broad permissions and shared accounts increase the potential blast radius, while flat resource access removes useful security boundaries. Workload identities should receive narrowly scoped permissions, and sensitive resources should be segmented where appropriate. This approach supports Zero Trust and reduces the impact of application compromise.

Question 125

Which security architecture capability provides a visual representation of security metrics and operational information for analysts?

1. Microsoft Sentinel workbooks
2. Microsoft Entra B2B
3. Azure Key Vault
4. Azure Private Link

Correct Answer: 1
Explanation

Microsoft Sentinel workbooks provide dashboards and visualizations that help security teams understand security data, trends, incidents, and operational metrics. They can combine information from different sources into views that support investigation and reporting. Entra B2B addresses external collaboration, Key Vault manages secrets and cryptographic material, and Private Link provides private network connectivity. Workbooks can help security teams identify patterns and communicate security information, although the quality of the resulting dashboard depends on the underlying telemetry and queries.

Question 126

Which capability helps a security operations team enrich Sentinel investigations with known indicators such as malicious IP addresses or domains?

1. Azure Policy
2. Threat intelligence
3. Azure Bastion
4. Resource locks

Correct Answer: 2
Explanation

Threat intelligence provides information about known or suspected malicious indicators that can be used to enrich security investigations and detections. In Microsoft Sentinel, threat intelligence can help analysts correlate events with indicators such as IP addresses, domains, URLs, or file hashes. This additional context can help prioritize investigations and identify potentially malicious activity. Azure Policy governs resource configurations, Azure Bastion provides secure administrative connectivity, and resource locks help prevent accidental changes. Threat intelligence should be evaluated for reliability, freshness, and relevance.

Question 127

An organization wants to prevent sensitive information from being copied to unauthorized cloud applications. Which architectural approach should be considered?

1. Data loss prevention controls
2. Public sharing by default
3. Unrestricted application access
4. Anonymous file transfers

Correct Answer: 1
Explanation

Data loss prevention controls can identify sensitive information and apply policies designed to prevent inappropriate movement, sharing, or transmission. This can be particularly useful when employees use cloud applications to process organizational data. Public sharing and unrestricted application access increase the risk of unauthorized disclosure, while anonymous transfers weaken accountability. DLP should be based on data classification, business requirements, user roles, and applicable compliance obligations. Security architects should also consider user experience so that legitimate business activities are not unnecessarily blocked.

Question 128

Which Azure capability can help prevent accidental deletion or modification of important Azure resources?

1. Azure Resource Locks
2. Azure DNS
3. Azure Front Door
4. Azure Load Balancer

Correct Answer: 1
Explanation

Azure Resource Locks can help protect resources against accidental deletion or modification by applying management restrictions at the resource or resource-group level. Locks are useful for protecting critical infrastructure and other resources where unintended administrative changes could cause outages or data loss. DNS provides name resolution, Front Door provides application delivery capabilities, and Load Balancer distributes network traffic. Resource locks should not be treated as a replacement for access control because authorized users and privileged identities still require appropriate governance.

Question 129

Which Microsoft Defender capability is specifically designed to detect threats involving on-premises Active Directory identities and domain controllers?

1. Microsoft Defender for Identity
2. Microsoft Defender for Office 365
3. Microsoft Defender for Cloud Apps
4. Microsoft Defender for Cloud

Correct Answer: 1
Explanation

Microsoft Defender for Identity monitors signals from on-premises identity environments such as Active Directory to help detect identity-related threats and suspicious activities. It can help identify techniques involving domain controllers, compromised accounts, credential abuse, and lateral movement. Defender for Office 365 focuses on email and collaboration threats, Defender for Cloud Apps provides cloud application security capabilities, and Defender for Cloud addresses cloud and hybrid workload security. Defender for Identity is especially relevant in hybrid architectures where on-premises identity infrastructure remains important.

Question 130

A security architect needs to ensure that administrators cannot directly use highly privileged accounts for routine email and web browsing. Which approach supports this requirement?

1. Separate privileged and standard identities
2. Shared administrator accounts
3. Permanent global administrator sessions
4. Unrestricted browser access

Correct Answer: 1
Explanation

Separating privileged and standard identities reduces the chance that highly privileged credentials will be exposed during routine activities such as email, web browsing, or document handling. Administrators can use standard accounts for normal work and privileged identities only when administrative tasks require elevated permissions. Shared accounts and unrestricted privileged sessions increase exposure and reduce accountability. This model works particularly well when combined with privileged access workstations, strong authentication, just-in-time elevation, monitoring, and administrative session controls.

Question 131

Which Azure service can provide distributed denial-of-service protection for applications and network resources?

1. Azure DDoS Protection
2. Azure Key Vault
3. Azure Policy
4. Azure Automation

Correct Answer: 1
Explanation

Azure DDoS Protection is designed to help protect supported Azure resources against distributed denial-of-service attacks. It provides capabilities intended to detect and mitigate attack traffic while helping maintain application and network availability. Key Vault protects secrets and cryptographic assets, Azure Policy manages resource governance, and Azure Automation provides automation capabilities. DDoS protection should be considered as part of a broader availability architecture that includes resilient application design, monitoring, capacity planning, and appropriate network controls.

Question 132

Which architectural control is most appropriate for securely connecting administrators to Azure virtual machines without exposing management ports directly to the public internet?

1. Azure Load Balancer
2. Azure Bastion
3. Azure DNS
4. Azure Storage

Correct Answer: 2
Explanation

Azure Bastion provides managed, browser-based connectivity to Azure virtual machines without requiring direct exposure of common management ports such as RDP or SSH through public IP addresses. This can reduce the attack surface associated with publicly accessible administrative endpoints. Load Balancer distributes traffic, DNS provides name resolution, and Storage manages data. Bastion should still be combined with identity controls, strong authentication, least privilege, monitoring, and appropriate network segmentation to provide secure administrative access.

Question 133

A company wants to scan infrastructure-as-code templates for insecure configurations before deployment. Which DevSecOps practice should be implemented?

1. Infrastructure-as-code security scanning
2. Manual password sharing
3. Production-only testing
4. Post-deployment documentation

Correct Answer: 1
Explanation

Infrastructure-as-code security scanning evaluates templates for potentially insecure configurations before resources are deployed. Identifying problems earlier allows development and security teams to correct issues before they become production vulnerabilities. This practice can examine areas such as excessive permissions, insecure network exposure, weak encryption settings, and noncompliant configurations. Production-only testing delays detection and may increase remediation costs. IaC scanning should be integrated into development and CI/CD workflows and complemented by runtime configuration monitoring and policy enforcement.

Question 134

Which practice helps prevent application dependencies with known vulnerabilities from being introduced into production?

1. Dependency scanning
2. Disabling vulnerability management
3. Shared production credentials
4. Manual network configuration

Correct Answer: 1
Explanation

Dependency scanning evaluates software libraries and packages used by applications to identify known vulnerabilities and other security concerns. Integrating this process into development pipelines can help teams identify vulnerable components before applications are released. Disabling vulnerability management removes an important security control, while shared credentials and manual network configuration address unrelated concerns. Dependency scanning should be combined with secure development practices, software composition analysis, patch management, and appropriate policies for handling vulnerabilities that cannot immediately be remediated.

Question 135

Which control can help ensure that a production deployment cannot proceed until required security checks have successfully completed?

1. Security gates in CI/CD pipelines
2. Unrestricted deployment permissions
3. Manual credential sharing
4. Disabled build validation

Correct Answer: 1
Explanation

Security gates can require defined checks to pass before a CI/CD pipeline is allowed to continue toward production. Depending on the architecture, gates may evaluate code scanning, dependency vulnerabilities, infrastructure configuration, secrets detection, tests, approvals, or compliance requirements. Unrestricted deployment permissions and disabled validation increase the risk of insecure changes reaching production. Security gates should be designed according to risk and should provide clear exception processes when legitimate deployment requirements conflict with automated controls.

Question 136

Which Microsoft Purview capability is designed to apply persistent sensitivity information to documents and emails?

1. Retention policies
2. Sensitivity labels
3. Audit logs
4. eDiscovery searches

Correct Answer: 2
Explanation

Sensitivity labels in Microsoft Purview help organizations classify and protect documents and emails according to their sensitivity. Depending on configuration, labels can be associated with protection settings such as encryption or usage restrictions. Retention policies address how long content should be retained, audit logs provide activity information, and eDiscovery supports investigation and legal discovery. Sensitivity labeling is therefore an important component of a data-centric security architecture because it helps organizations apply protection based on the information’s classification and business value.

Question 137

An organization wants to identify unusual behavior by users and entities using multiple security signals. Which Sentinel capability can support this objective?

1. User and Entity Behavior Analytics
2. Azure Resource Locks
3. Azure Private Link
4. Azure DNS

Correct Answer: 1
Explanation

User and Entity Behavior Analytics, or UEBA, can help identify unusual patterns by establishing behavioral context for users and entities. In security operations, this can provide additional insight when investigating activities that may differ from normal behavior. UEBA can contribute to risk-based detection and investigation by considering relationships and behavioral patterns rather than relying only on individual events. Resource Locks, Private Link, and DNS provide infrastructure controls and do not perform behavioral analytics. UEBA should be interpreted alongside other security signals and organizational context.

Question 138

Which architecture strategy helps ensure that backup data cannot easily be altered or deleted by an attacker who compromises production credentials?

1. Immutable or protected backups
2. Shared backup administrator accounts
3. Permanent production access
4. Unrestricted backup modification

Correct Answer: 1
Explanation

Immutable or otherwise strongly protected backups can help prevent attackers from modifying or deleting recovery data after compromising production systems. This is particularly important during ransomware incidents, where attackers may attempt to destroy backups before encrypting production resources. Backup protection can include immutability, separate administrative controls, isolation, strong authentication, monitoring, and appropriate retention. Shared credentials and unrestricted modification increase risk. Backup architecture should be tested regularly to confirm that recovery procedures actually work when production systems are unavailable.

Question 139

Which architectural approach helps reduce the risk of a compromised cloud workload accessing secrets belonging to unrelated workloads?

1. Centralized shared administrator passwords
2. Workload-specific identities and scoped permissions
3. Publicly accessible secret stores
4. Common credentials for every application

Correct Answer: 2
Explanation

Workload-specific identities with narrowly scoped permissions ensure that each application or service receives only the access required for its function. If one workload is compromised, the attacker is less likely to obtain credentials or secrets belonging to unrelated applications. Shared administrator passwords and common credentials significantly increase the blast radius of a compromise. Public secret stores are also inappropriate for sensitive information. Combining workload identities with Key Vault, managed identities, least privilege, and monitoring creates a stronger application security architecture.

Question 140

A security architecture team needs to measure whether its controls are improving the organization’s security posture over time. Which approach is most useful?

1. Security metrics and key risk indicators
2. Ignoring security telemetry
3. Measuring only infrastructure cost
4. Removing security baselines

Correct Answer: 1
Explanation

Security metrics and key risk indicators help organizations measure changes in security posture and determine whether controls are producing the intended outcomes. Useful measurements can include vulnerability exposure, privileged access, incident response times, policy compliance, control coverage, and unresolved security risks. Measuring only infrastructure cost does not provide sufficient security insight, while ignoring telemetry removes valuable evidence. Security metrics should be tied to business and security objectives so that architecture teams can identify gaps, prioritize improvements, and track progress over time.