SC-100 practice questions

Question 1. Leadership asks whether to use the CAF or the WAF to guide an organisation-wide cloud adoption and governance programme spanning strategy, landing zones and ongoing management. Which framework fits, and why?

1. The WAF, because it is organisation-scoped and covers governance
2. The CAF, because it reviews a single workload across five pillars
3. The WAF, because it provisions landing zones
4. The CAF, because it is organisation-scoped and covers the full adoption journey and governance

Question 2. A stakeholder says 'we bought a Zero Trust product, so we are done'. What is the most accurate architect response?

1. Zero Trust means trusting everything inside the corporate network
2. Zero Trust only applies to the network firewall
3. Zero Trust is a strategy applied across identity, endpoints, data, apps, infrastructure and network, not a single product
4. Correct, one product fully implements Zero Trust

Question 3. A team wants to add security to the software delivery process, covering design, code, pipeline and operations. Which approach and example controls should the architect recommend?

1. A single annual manual security review after release
2. Security only at the operations stage, once live
3. DevSecOps: threat modelling in design, dependency and secret scanning in code, automated checks in the pipeline, posture management and pen testing in operations
4. Relying on developers to remember to check security

Question 4. An architect is defining the recovery plan for ransomware resilience. Which pair of measures sets how much data loss and how much downtime are acceptable, and so drives the backup design?

1. Mean time between failures (MTBF) and mean time to detect (MTTD)
2. Recovery point objective (RPO) and recovery time objective (RTO)
3. Service level agreement (SLA) and key performance indicator (KPI)
4. Attack surface reduction (ASR) and multifactor authentication (MFA)

Question 5. An architect is threat modelling a new generative AI copilot using STRIDE, but a colleague argues STRIDE alone is enough and no AI-specific guidance is needed. Following CAF guidance for secure AI adoption, how should the architect respond?

1. Agree, because STRIDE alone fully covers generative AI risks
2. Supplement STRIDE with AI-specific frameworks such as MITRE ATLAS and the OWASP Top 10 for Generative AI, since these cover risks like prompt injection and model manipulation that STRIDE does not name
3. Skip threat modelling entirely for AI workloads since they are still new
4. Replace STRIDE entirely, since it does not apply to any cloud workload

Question 6. Security wants even a Global Administrator to be forced through phishing-resistant MFA from a compliant device before they can modify Conditional Access policies, so a stolen token alone cannot weaken the controls. What should the architect use?

1. A break-glass account
2. A named location policy
3. Password protection
4. Protected actions

Question 7. Contoso must let partner organisations access a shared application using their own corporate identities, with the trust relationship governed centrally. Which design should the architect choose?

1. A shared username and password for all partners
2. Microsoft Entra External ID B2B collaboration with cross-tenant access settings
3. Creating internal Entra accounts for every partner user
4. Federating the partners into on-premises Active Directory

Question 8. A design must respond automatically when a sign-in looks risky, for example from an anonymising proxy, by requiring MFA. Which capability provides the risk signal and response, and what licence is needed?

1. Microsoft Entra ID Protection with risk-based Conditional Access, requiring Entra ID P2
2. Azure Policy with a deny effect, no licence needed
3. Microsoft Purview DLP, requiring E3
4. A network security group, requiring no licence

Question 9. An architect wants to prevent a misconfigured Conditional Access policy from locking every administrator out of the tenant. What should the design include?

1. Disabling Conditional Access entirely
2. One shared admin password written down
3. Two or more cloud-only break-glass accounts, excluded from the lockout-capable policies, strongly protected and alerting on any use
4. Making every user a Global Administrator

Question 10. An architect wants to audit, across every subscription, alignment with a recognised standard such as ISO 27001 using built-in content. Which capability provides this?

1. Azure Policy built-in regulatory compliance initiatives assigned at a management group
2. A manually maintained checklist
3. Microsoft Entra access reviews
4. Microsoft Defender for Endpoint device inventory

Question 11. Security wants to eliminate the risk that one stolen local administrator password can be reused to move laterally across every workstation. Which capability should the design include?

1. Granting all users local administrator rights
2. A single strong local admin password documented in a shared vault
3. Disabling MFA to simplify admin logins
4. Windows LAPS to randomise and rotate each device's local admin password, stored in Entra ID

Question 12. A design must keep traffic to an Azure SQL database and a storage account entirely off the public internet while still reachable from the application subnet. Which should the architect use?

1. A site-to-site VPN to Microsoft's datacentre
2. A public endpoint restricted by a weak firewall rule
3. Private endpoints (Azure Private Link) with public network access disabled
4. Exposing the services with a public IP and NSG

Question 13. A team runs Kubernetes on AKS and needs image scanning, control-plane hardening and runtime threat detection. Which Microsoft solution should the architect specify?

1. Windows LAPS
2. Microsoft Defender for Containers
3. Azure DDoS Protection
4. Microsoft Purview Compliance Manager

Question 14. An architect must inspect outbound TLS-encrypted traffic and detect intrusions at the network edge for a regulated workload. Which should be specified?

1. A standard network security group
2. Azure DDoS Protection alone
3. A public IP with no filtering
4. Azure Firewall Premium (with TLS inspection and IDPS)

Question 15. An architect must extend Defender for Cloud posture and workload protection to on-premises servers and a GCP project. Which onboarding approach is correct?

1. Only Azure resources can be protected, so nothing can be done
2. Rebuild all workloads in Azure first
3. Onboard on-premises servers via Azure Arc and connect the GCP project with the multicloud connector
4. Install a separate, unintegrated tool in each environment

Question 16. A regulated bank must ensure that even its own database administrators cannot read customers' card numbers stored in Azure SQL, while the rest of the database uses standard at-rest protection. Which combination fits?

1. Only network security groups on the database subnet
2. TDE alone for the whole database
3. Disabling auditing to reduce exposure of the data
4. Always Encrypted for the card columns, with transparent data encryption (TDE) for the database at rest

Question 17. An architect must measure and improve the security posture of Microsoft 365 collaboration and productivity workloads with prioritised, points-based actions. Which should be used?

1. The Azure pricing calculator
2. Microsoft Entra entitlement management only
3. Microsoft Secure Score, alongside Microsoft Defender for Office 365
4. Azure Advisor cost recommendations

Question 18. A regulated organisation must control the rotation and revocation of the keys that encrypt its Azure Storage data. Which design meets this?

1. Rely on the default platform-managed keys
2. Customer-managed keys (CMK) in Azure Key Vault Premium or Managed HSM, optionally with infrastructure encryption
3. Disable encryption to simplify key handling
4. Store the key in the application configuration

Question 19. An organisation must protect email against weaponised links that are clean at delivery but malicious when clicked, and against malicious attachments. Which Microsoft 365 capability should the architect evaluate?

1. Azure Firewall Premium
2. Microsoft Defender for Storage
3. Windows LAPS
4. Microsoft Defender for Office 365 (Safe Links and Safe Attachments)

Question 20. A design must protect specific card-number columns in Azure SQL so that even database administrators cannot read the plaintext, while the rest of the database is encrypted at rest transparently. Which combination fits?

1. Dynamic data masking plus a network security group
2. Transparent data encryption alone
3. Always Encrypted for the card columns plus transparent data encryption for the database
4. Deleting the columns and storing them in a spreadsheet