Microsoft SC-100 Practice Test 1

Question 1

A cybersecurity architect is evaluating the following business requirement: IoT devices authenticate to a cloud hub using one credential shared by the full fleet. Which architecture recommendation BEST addresses the case?

Authenticate senders and validate command authorization and schema at the IoT service boundary.
Require signed firmware artifacts and restricted update distribution with rollback safeguards.
Define edge-data encryption, retention and secure wipe requirements for IoT decommissioning.
Provision per-device identities and revoke individual compromised devices without changing all peers.

Explanation

Correct Answer

Unique credential scope allows containment of one compromised sensor. This choice directly fits the stated architecture requirement.

Incorrect Answers

This recommendation fits a different scenario: A cloud function processes device telemetry without validating which device supplied a command message. Ingestion connectivity does not imply that every source can issue operational commands. It does not solve the specified case, for which Provision per-device identities and revoke individual compromised devices without changing all peers. is appropriate.

This recommendation fits a different scenario: A firmware update service accepts unsigned update packages from a writable public bucket. Device trust depends on verifiable software provenance before installing updates. It does not solve the specified case, for which Provision per-device identities and revoke individual compromised devices without changing all peers. is appropriate.

This recommendation fits a different scenario: An edge gateway caches sensitive sensor data indefinitely after devices are retired. Device lifecycle includes safeguarding residual local data and credentials. It does not solve the specified case, for which Provision per-device identities and revoke individual compromised devices without changing all peers. is appropriate.

Question 2

A hybrid-cloud design review identifies this security gap: A hybrid organization creates cloud identities independently of local AD and users appear twice after synchronization. Which action is MOST appropriate for the stated need?

Define authoritative identity source and matching rules before enabling hybrid provisioning.
Federate workload administration to governed identities and enforce provider-specific least privilege.
Design supported redundant provisioning agents and monitor synchronization health.
Validate synchronization scope changes and accidental-delete protections before exporting.

Explanation

Correct Answer

Stable source matching prevents duplicate principals and fractured entitlements. This choice directly fits the stated architecture requirement.

Incorrect Answers

This recommendation fits a different scenario: A multicloud team reuses one shared cloud administrator password across AWS and Azure consoles. Unified sign-in need not mean one shared standing administrator credential. It does not solve the specified case, for which Define authoritative identity source and matching rules before enabling hybrid provisioning. is appropriate.

This recommendation fits a different scenario: A Cloud Sync design omits agent redundancy even though on-premises directory provisioning is business-critical. Identity lifecycle resilience depends on the availability of the provisioning pathway. It does not solve the specified case, for which Define authoritative identity source and matching rules before enabling hybrid provisioning. is appropriate.

This recommendation fits a different scenario: The team moves user objects between source OUs without assessing deletion effects in the cloud directory. Moving objects out of scope can trigger unintentional cloud deprovisioning. It does not solve the specified case, for which Define authoritative identity source and matching rules before enabling hybrid provisioning. is appropriate.

Question 3

During a security architecture workshop, the team learns that: A bank wants a view of cloud resources aligned to a particular benchmark across Azure subscriptions. What should the cybersecurity architect recommend?

Design eligible Defender for Cloud multicloud connectors and verify assessment coverage per account.
Track compliance trends and reassess benchmark mapping after changes to policy or resource scope.
Evaluate Defender for Cloud regulatory compliance standards and their mapped assessment evidence.
Validate manual procedures, application responsibilities and excluded assets alongside automated assessments.

Explanation

Correct Answer

Regulatory dashboards correlate supported control assessments with relevant resource states. This choice directly fits the stated architecture requirement.

Incorrect Answers

This recommendation fits a different scenario: A multicloud program needs comparable cloud-security assessments across AWS and Azure but has only onboarded Azure. Unconnected environments create blind spots in consolidated regulatory monitoring. It does not solve the specified case, for which Evaluate Defender for Cloud regulatory compliance standards and their mapped assessment evidence. is appropriate.

This recommendation fits a different scenario: A control's compliance state changes after the security team modifies its underlying cloud policy but never reviews effects. Control evaluation results depend on the active baseline and monitored inventory. It does not solve the specified case, for which Evaluate Defender for Cloud regulatory compliance standards and their mapped assessment evidence. is appropriate.

This recommendation fits a different scenario: The audit team mistakes a green Defender for Cloud regulatory dashboard for a guarantee of legal compliance. Technical posture evidence cannot prove every organizational and legal obligation. It does not solve the specified case, for which Evaluate Defender for Cloud regulatory compliance standards and their mapped assessment evidence. is appropriate.

Question 4

A multinational enterprise reports this risk: Backups contain executable images from the period when attackers already had domain administrator access. Which change MOST directly mitigates the design gap?

Validate backup recovery points and restore in an isolated clean environment before reconnecting workloads.
Add business reconciliation and integrity checks before declaring financial service recovery complete.
Coordinate forensic preservation and priority restoration using segregated evidence and recovery environments.
Define end-to-end application recovery acceptance tests including identity, network and dependent service calls.

Explanation

Correct Answer

Restoring from already compromised images can reactivate malicious persistence and undo containment. This choice directly fits the stated architecture requirement.

Incorrect Answers

This recommendation fits a different scenario: A critical financial workload is restored but no one compares its ledger balance to the last trusted state. Infrastructure availability does not prove transaction completeness or correctness after rollback. It does not solve the specified case, for which Validate backup recovery points and restore in an isolated clean environment before reconnecting workloads. is appropriate.

This recommendation fits a different scenario: The SOC wants to preserve forensic evidence while operations teams demand an immediate full wipe of affected systems. Recovery planning should prevent unnecessary evidence destruction while allowing essential services to resume. It does not solve the specified case, for which Validate backup recovery points and restore in an isolated clean environment before reconnecting workloads. is appropriate.

This recommendation fits a different scenario: A site failover test reports success because a VM boots, yet user authentication and dependent APIs remain inaccessible. A virtual machine startup alone cannot validate an end-user recovery objective. It does not solve the specified case, for which Validate backup recovery points and restore in an isolated clean environment before reconnecting workloads. is appropriate.

Question 5

An architecture approval board must resolve this concern: A company stores daily backups under the same highly privileged credentials as production and ransomware encrypts both. Which architecture recommendation BEST addresses the case?

Schedule integrity-checked recovery tests that measure actual restore time and application consistency.
Specify independent backup and restoration controls in addition to legal retention enforcement.
Place recovery data in approved geographically independent locations and validate regional-failover dependencies.
Design isolated, access-restricted and immutable backup copies with independent administration.

Explanation

Correct Answer

Separation and immutability reduce the chance that one compromise destroys the recovery source alongside production. This choice directly fits the stated architecture requirement.

Incorrect Answers

This recommendation fits a different scenario: A cloud storage backup exists but no administrator has successfully restored a sample application. Backup job success cannot establish that the protected data can be restored within the declared recovery time. It does not solve the specified case, for which Design isolated, access-restricted and immutable backup copies with independent administration. is appropriate.

This recommendation fits a different scenario: A legal records system has a five-year retention policy, and its owner assumes that policy is equivalent to point-in-time backups. Compliance retention preserves governed records while recoverable versions and tested restore workflows address operational failure. It does not solve the specified case, for which Design isolated, access-restricted and immutable backup copies with independent administration. is appropriate.

This recommendation fits a different scenario: A hybrid estate needs protection from a cloud-region failure while avoiding backups confined to that same region. Regional fault isolation requires recovery resources that do not share the unavailable location's failure domain. It does not solve the specified case, for which Design isolated, access-restricted and immutable backup copies with independent administration. is appropriate.

Question 6

A security engineering lead describes the following problem: A Copilot user can summarize files the organization did not intend to share because SharePoint site permissions are broad. Which action is MOST appropriate for the stated need?

Design supported Copilot audit and activity-monitoring evidence with privacy-aware access.
Remediate excessive SharePoint and Microsoft 365 content permissions before broad Copilot rollout.
Evaluate supported Microsoft Purview DLP and information-protection controls for Copilot interactions.
Separate AI content safety from underlying data permission and labeling governance.

Explanation

Correct Answer

Copilot can surface content a user can already access, making oversharing a priority risk. This choice directly fits the stated architecture requirement.

Incorrect Answers

This recommendation fits a different scenario: A security architect cannot explain which user actions and protected data sources Copilot accessed during an incident. Investigations require traceability while restricting access to sensitive interaction logs. It does not solve the specified case, for which Remediate excessive SharePoint and Microsoft 365 content permissions before broad Copilot rollout. is appropriate.

This recommendation fits a different scenario: An organization deploys Copilot without deciding whether confidential prompts and generated responses belong in its DLP scope. AI workflows require product-specific data protection scope rather than assuming email-only rules apply. It does not solve the specified case, for which Remediate excessive SharePoint and Microsoft 365 content permissions before broad Copilot rollout. is appropriate.

This recommendation fits a different scenario: A compliance board assumes prompt safety filters prevent leakage from an over-permissioned document corpus. Safety filters do not replace ACLs on retrieved business documents. It does not solve the specified case, for which Remediate excessive SharePoint and Microsoft 365 content permissions before broad Copilot rollout. is appropriate.

Question 7

A governance team has raised this design requirement: A cloud application stores long-lived client secrets in a code repository and rotates them only when employees leave. What should the cybersecurity architect recommend?

Define independent keys, access scopes and rotation policies per workload and trust boundary.
Use Azure Key Vault or an equivalent managed secret service with controlled rotation and access policies.
Establish certificate inventory, expiry monitoring and tested renewal procedures for trust-critical services.
Evaluate managed or hardware-protected key custody with separate key administration roles.

Explanation

Correct Answer

Central secret custody and rotation reduce exposure from hard-coded credentials. This choice directly fits the stated architecture requirement.

Incorrect Answers

This recommendation fits a different scenario: A multicloud application shares the same encryption key material broadly between unrelated environments. Distinct cryptographic domains prevent one breach from revealing unrelated protected data. It does not solve the specified case, for which Use Azure Key Vault or an equivalent managed secret service with controlled rotation and access policies. is appropriate.

This recommendation fits a different scenario: A service certificate expires and causes an identity federation outage across the enterprise. Certificate lifecycle is an availability dependency of cryptographic trust. It does not solve the specified case, for which Use Azure Key Vault or an equivalent managed secret service with controlled rotation and access policies. is appropriate.

This recommendation fits a different scenario: A workload needs cryptographic operations while the application operators must not be able to export the master key. Nonexportable key control and separation of duties reduce the blast radius of app compromise. It does not solve the specified case, for which Use Azure Key Vault or an equivalent managed secret service with controlled rotation and access policies. is appropriate.

Question 8

A regulated organization needs a safer design because: External employees receive SharePoint and app grants through many manual requests without expiry dates. Which change MOST directly mitigates the design gap?

Schedule sponsor-backed access reviews and remove no-longer-justified assignments.
Inventory direct, group-based and application grants when evaluating effective access.
Require approval records and access-package ownership for external resource entitlements.
Use access packages with approval, expiration and review controls where supported.

Explanation

Correct Answer

Entitlement workflows govern the full lifecycle of bundled resource access. This choice directly fits the stated architecture requirement.

Incorrect Answers

This recommendation fits a different scenario: A project manager approves access packages but cannot determine who still has access when a project closes. Periodic attestation identifies permissions that outlive their original purpose. It does not solve the specified case, for which Use access packages with approval, expiration and review controls where supported. is appropriate.

This recommendation fits a different scenario: A group owner assumes removal from a Teams channel automatically revokes every separate application assignment. User access can come from multiple independent authorization paths. It does not solve the specified case, for which Use access packages with approval, expiration and review controls where supported. is appropriate.

This recommendation fits a different scenario: A sensitive application allows broad guest onboarding with no evidence of who approved the initial grant. Authorization should be tied to a named sponsor and approved business need. It does not solve the specified case, for which Use access packages with approval, expiration and review controls where supported. is appropriate.

Question 9

A cybersecurity architect is evaluating the following business requirement: Employees need access to an internal application without being connected to a broad network-level VPN. Which architecture recommendation BEST addresses the case?

Validate private access app segments, DNS resolution and forwarding policy for the target.
Keep backend application authentication and resource permission checks under the Private Access architecture.
Evaluate Microsoft Entra Private Access with published application segments and scoped user grants.
Design supported connector redundancy and verify private application availability during failure.

Explanation

Correct Answer

Zero Trust private access can expose an application rather than a whole internal subnet. This choice directly fits the stated architecture requirement.

Incorrect Answers

This recommendation fits a different scenario: A private app is published but an authorized user cannot reach its service hostname through the client. A user grant alone does not establish name resolution or routing to the application. It does not solve the specified case, for which Evaluate Microsoft Entra Private Access with published application segments and scoped user grants. is appropriate.

This recommendation fits a different scenario: A team migrates from VPN and assumes private access removes the need for server-side authorization. Network path authorization complements but does not replace app-level access control. It does not solve the specified case, for which Evaluate Microsoft Entra Private Access with published application segments and scoped user grants. is appropriate.

This recommendation fits a different scenario: An application connector is deployed in only one location and becomes unavailable during routine maintenance. Private access depends on healthy connectors and backend reachability. It does not solve the specified case, for which Evaluate Microsoft Entra Private Access with published application segments and scoped user grants. is appropriate.

Question 10

A hybrid-cloud design review identifies this security gap: A SOC investigates user phishing incidents without checking related endpoint and identity alerts. Which action is MOST appropriate for the stated need?

Design Microsoft 365 network optimization alongside appropriate identity and data security policies.
Implement guest lifecycle and sponsor-backed entitlement reviews across supported workloads.
Verify monitoring coverage and telemetry health before interpreting low alert counts as low risk.
Correlate Office 365 detections with Defender XDR cross-workload incidents.

Explanation

Correct Answer

Email threats can lead to identity and endpoint compromise that a mailbox-only view misses. This choice directly fits the stated architecture requirement.

Incorrect Answers

This recommendation fits a different scenario: A network team proposes exempting all Teams traffic from every security control to resolve poor call quality. Performance optimization should not eliminate resource authorization or protection. It does not solve the specified case, for which Correlate Office 365 detections with Defender XDR cross-workload incidents. is appropriate.

This recommendation fits a different scenario: A tenant allows external collaboration but no one reviews guests after their projects end. External collaboration risk persists when access remains after legitimate need ends. It does not solve the specified case, for which Correlate Office 365 detections with Defender XDR cross-workload incidents. is appropriate.

This recommendation fits a different scenario: A Microsoft 365 compliance dashboard shows no incidents, but several workloads are not licensed or connected for security signals. Missing detection evidence cannot prove the environment is safe because unmonitored services may conceal otherwise detectable threats. It does not solve the specified case, for which Correlate Office 365 detections with Defender XDR cross-workload incidents. is appropriate.