SC-100 sample exam questions

Deleted originals in SharePoint Online and OneDrive can be restored from the Recycle Bin (93 days), and files encrypted in place can be rolled back with built-in versioning, both with no extra setup. DLP policies prevent data sharing, not encryption damage.

In the RaMP privileged access model, the privileged device user must not be a local administrator; only the dedicated device management group (Group2) is added to local Administrators, enforcing least privilege. Adding the Security Administrator user to local admins weakens the device, and LAPS legacy emulation mode is unrelated.

Entra Permissions Management is a CIEM tool for Azure, AWS and GCP: it discovers granted vs used permissions, computes the Permission Creep Index, removes unused permissions and grants permissions on demand. Note: Microsoft retired Permissions Management for new customers in 2025, so this feature is outdated.

Quick Verified ID setup uses a custom domain verified in the Microsoft Entra tenant to build the issuer's decentralized identifier, so the custom domain must exist first. Quick setup removes the need to create your own Azure Key Vault or app registrations, unlike advanced setup.

Azure Update Manager offers on-demand assessment and deployment, supports hotpatching on Azure Edition, and delivers ESU patches to Arc-enabled servers. On-premises machines need the Azure Connected Machine agent. Automation Update Management and the Log Analytics agent are retired.

Compliance Manager connectors (multicloud support for Azure, AWS and GCP) let Compliance Manager automatically assess and monitor those clouds, with improvement actions that include implementation guidance and little effort. Defender for Cloud, Defender for Cloud Apps and Sentinel are not Compliance Manager components.

Private endpoints give the apps private addresses in VNet1 that Site1 reaches across the VPN, whereas service endpoints do not serve on-premises traffic. NSGs on the endpoint subnet let VNet1 security administrators filter by server address at no cost. Azure Firewall would add cost.

Azure Front Door with WAF inspects global HTTP traffic using the Microsoft default rule set based on OWASP CRS, supports Front Door-managed certificates, and routes users to the closest healthy app. Application Gateway is regional, and Azure Firewall does not provide OWASP CRS web inspection or geographic routing.

DART post-breach guidance for compromised computers is to isolate the machine with Defender for Endpoint device (machine) isolation, cutting network access except to the Defender service while keeping investigation possible. Controlled folder access and memory scanning are preventive, and app or user isolation are not the DART containment action.

A security PIN is required for critical Azure Backup operations, so stolen credentials alone cannot destroy backups. Immutable storage keeps blobs in a write-once state that ransomware cannot alter. Outdated: Azure Backup now also offers immutable vaults and multi-user authorization.

A custom Azure RBAC role grants the InfraSec group exactly the permissions the case study requires, following least privilege. Subscriptions, resource groups and management groups are only scopes where a role is assigned; they do not define which actions are delegated.

Azure Virtual Desktop gives users access to the VMs' applications and desktops through a brokered service without exposing the VMs or opening RDP, meeting the case study security requirements. JIT, Bastion and NSGs are administrative or network controls that still require direct VM connections.

Service chaining uses user-defined routes across peered virtual networks to send landing zone internet-bound traffic through the hub firewall or NVA, meeting the landing zone requirements. Forced tunneling sends traffic back to on-premises, and local network gateways represent on-premises VPN endpoints.

Microsoft Entra Conditional Access (formerly Azure AD) controls access to SharePoint Online and Exchange Online based on device and risk conditions, and Defender for Cloud Apps adds session controls and data protection policies such as blocking downloads. Defender for Cloud, Defender for Endpoint and access reviews do not secure this data the same way.

Always Encrypted encrypts the MedicalHistory column on the client so even developers and DBAs with database access cannot see plaintext, meeting the developer requirement. Dynamic data masking only obscures query output and can be bypassed by privileged users, TDE protects data at rest only, and RLS filters rows.