This is the free Microsoft SC-100 practice question bank —
160 of 316 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-04-24.
Every answer is verified against official Microsoft documentation —
see our methodology.
Question 1
You have an Azure subscription that contains a web app named App1. App1 uses a Microsoft Entra user account named SRV1 as a service account to authenticate to an Azure SQL database named DB1.
You discover that a developer accessed DB1 directly by using SRV1.
You need to recommend a secure authentication method that will prevent credential misuse outside of App1. The solution must minimize administrative effort.
What should you recommend?
A. a managed identity
B. a group managed service account (gMSA)
C. a delegated managed service account (dMSA)
D. a federated identity credential
Show Answer
Correct Answer: A
Explanation: Using a managed identity for App1 eliminates shared credentials entirely. The identity is bound to the app, cannot be used interactively by developers, and can be granted access to Azure SQL DB1 with minimal administration. This prevents credential misuse outside of App1 and is the recommended secure approach.
Question 1
You have an Azure subscription and a Microsoft 365 subscription. All users are assigned Microsoft 365 E5 licenses. All computers run Windows 11 and are Microsoft Entra joined.
You need to recommend a solution to prevent computers that run early builds of Windows 11 from connecting to Microsoft 365 services.
Which two types of policies should you include in the recommendation? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. Microsoft Defender for Endpoint endpoint security policy
B. Microsoft Defender for Cloud regulatory compliance policy
C. Microsoft Intune compliance policy
D. Microsoft Entra ID Protection sign-in risk policy
E. Microsoft Entra Conditional Access policy
Show Answer
Correct Answer: C, E
Explanation: To prevent devices running early Windows 11 builds from accessing Microsoft 365 services, you need both a device posture evaluation and an access enforcement mechanism. An Intune compliance policy defines minimum OS version requirements and marks devices running unsupported or early builds as non-compliant. A Microsoft Entra Conditional Access policy then enforces access control by requiring devices to be marked compliant before granting access to Microsoft 365 services. Together, these policies ensure non-compliant devices are blocked.
Question 2
HOTSPOT
-
You have three on-premises servers that run Windows Server and contain shared folders. The folders contain 10,000 files.
You have a Microsoft 365 tenant that uses Microsoft Purview and includes custom sensitive information types (SITs).
You have an Azure subscription that contains five Azure Blob Storage accounts and multiple web apps. The Blob Storage accounts contain data for the web apps.
You need to recommend a Microsoft Purview solution to scan the storage blobs and the shared folders. The solution must use the custom SITs to identify files that contain specific data.
What should you use for each type of storage? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Storage blobs:
Data Map
Shared folders:
The Information Protection scanner
Explanation: Microsoft Purview Data Map can scan and classify data in Azure Blob Storage using custom sensitive information types. For on-premises Windows file shares, the Microsoft Purview Information Protection (AIP) scanner is required to discover and classify files using those custom SITs.
Question 2
You have an Azure subscription.
You have an on-premises datacenter. The datacenter contains 20 servers that run Windows Server. Each server is onboarded to Azure Arc and is protected by using Microsoft Defender for Servers Plan 1.
You have a Microsoft 365 subscription.
You need to recommend a solution to identify which servers have outdated hardware drivers or firmware.
What should you include in the recommendation?
A. Change all the servers to Microsoft Defender for Servers Plan 2.
B. Add the Microsoft Intune Suite add-on.
C. Onboard all the servers to Azure Update Manager.
D. Add Microsoft Defender Vulnerability Management add-ons.
Show Answer
Correct Answer: D
Explanation: Identifying outdated hardware drivers and firmware requires vulnerability and exposure assessment at the OS and hardware layer. Microsoft Defender Vulnerability Management provides inventory and assessment of missing updates, outdated drivers, and firmware on Arc‑enabled servers. Azure Update Manager focuses on patch deployment, not hardware/firmware visibility; Intune is not for servers; upgrading to Defender for Servers Plan 2 alone doesn’t add driver/firmware assessment without the Vulnerability Management capability.
Question 3
HOTSPOT
-
You have an on-premises datacenter. The datacenter contains a server named Server1 that runs Windows Server 2022 and a firewall that prevents Server1 from connecting to the internet.
You have an Azure subscription named Sub1.
You need to recommend a resiliency strategy for Server1 that incorporates a backup plan to transfer the data from Server1 to Sub1.
What should you include in the recommendation? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: For the on-premises datacenter:
The Microsoft Azure Recovery Services (MARS) agent
For Sub1:
A Recovery Services vault
Explanation: The MARS agent enables direct backup of on-premises Windows Server data to Azure without requiring Azure VM connectivity. Backups are stored and managed in a Recovery Services vault within the Azure subscription, which is the required Azure resource for Azure Backup.
Question 3
You have an Azure subscription.
You have an on-premises datacenter that contains Microsoft SQL Server instances. Each instance contains multiple databases.
You have a Microsoft 365 subscription.
You plan to implement a solution to scan the databases for vulnerabilities that compromise data security.
You need to recommend what to configure before the databases can be scanned.
What should you recommend?
A. Microsoft Purview data loss prevention (DLP)
B. Microsoft Purview data governance
C. Microsoft Defender for Cloud
D. Microsoft Defender Vulnerability Management
Show Answer
Correct Answer: C
Explanation: To scan SQL Server databases for security vulnerabilities, you must enable Microsoft Defender for Cloud. Defender for Cloud provides SQL vulnerability assessment capabilities and can assess on‑premises SQL Server instances when they are connected to Azure (for example, via Azure Arc). The other options focus on data governance, data loss prevention, or endpoint vulnerability management, not database vulnerability scanning.
Question 4
You have an Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named contoso.com. Sub1 contains 20 virtual networks named Sub1_VNet1 through Sub1_VNet20.
You have an Azure subscription named Sub2 that is linked to a Microsoft Entra tenant named fabrikam.com. Sub2 contains 20 virtual networks named Sub2_VNet1 through Sub2_VNet20.
You need to deploy an Azure Virtual Network Manager solution that meets the following requirements:
• Blocks SSH traffic on Sub1_VNet20 and Sub2_VNet20 by using network security groups (NSGs)
• Blocks SSH traffic on Sub1_VNet1 through Sub1_VNet19 and Sub2_VNet1 through Sub2_VNet19
• Allows SSH traffic on Sub1_VNet20 and Sub2_VNet20
• Blocks FTP traffic on all the virtual networks
• Minimizes administrative effort
What is minimum number of components required for the deployment?
Explanation: Azure Virtual Network Manager (AVNM) is scoped to a single Microsoft Entra tenant, so you need one AVNM instance per tenant (contoso.com and fabrikam.com), which means two instances total.
Within each tenant/subscription:
- You must block FTP on all VNets.
- You must block SSH on VNets 1–19 but allow SSH on VNet20.
To minimize administrative effort while meeting these conflicting requirements, you need:
- Two NSGs: one applied to VNets 1–19 (SSH denied, FTP denied) and one applied to VNet20 (SSH allowed, FTP denied).
- Two rule collections: one containing the deny rules (SSH + FTP) and one containing the allow SSH exception for VNet20.
Thus, each AVNM instance requires 2 NSGs and 2 rule collections, making option C the minimum valid configuration.
Question 4
HOTSPOT
-
You have a Microsoft Entra tenant named contoso.com that is linked to an Azure subscription named Sub1 and a Microsoft 365 subscription. Sub1 contains a publicly accessible Azure App Service web app named App1.
You have an external partner that has a Microsoft Entra tenant named fabrikam.com.
You need to recommend a solution that meets the following requirements:
• Ensures that the users in fabrikam.com can be granted permissions to specific Microsoft Teams channels in contoso.com
• Ensures that the users of App1 can authenticate by using social media accounts
• Minimizes administrative effort
Which authentication method should you recommend for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: B2B direct connect
Microsoft Entra External ID for customers
Explanation: B2B direct connect enables external tenant users to access specific Microsoft Teams shared channels with minimal administration. Microsoft Entra External ID for customers supports social identity providers (e.g., Google, Facebook) for authenticating users to public-facing apps like App Service.
Question 5
You have an on-premises server named Server1. Server1 is an FTP server that can be accessed by only the users at your company.
You have an Azure subscription.
You need to recommend a Zero Trust Network Access (ZTNA) solution to enforce Conditional Access policies when users access Server1 from the internet.
What should you include in the recommendation?
A. Microsoft Entra application proxy
B. Microsoft Entra Internet Access
C. Microsoft Entra Private Access
D. Azure Application Gateway
E. Azure Bastion
Show Answer
Correct Answer: C
Explanation: Microsoft Entra Private Access is Microsoft’s Zero Trust Network Access (ZTNA) solution for publishing and securing access to private on‑premises resources. It allows users to access Server1 from the internet while enforcing Conditional Access policies, aligning with Zero Trust principles and replacing traditional VPN-based access.
Question 5
You are designing a ransomware mitigation strategy.
You perform a ransomware risk assessment and identify business-critical assets.
You need to recommend a solution to mitigate ransomware threats. The solution must follow Microsoft security best practices.
Which two actions should you include in the recommendation? Each correct answer presents a complete solution.
NOTE: Each correct answer is worth one point.
A. Enable firewall logging for auditing, without restricting inbound or outbound traffic.
B. Use extended patching cycles to reduce the risk of update-related service disruptions.
C. Implement immutable, offline backups that have restricted access and test restore procedures regularly.
D. Deploy Privileged Identity Management (PIM) that uses just-in-time (JIT) access and approval workflows.
Show Answer
Correct Answer: C, D
Explanation: Microsoft ransomware mitigation best practices emphasize both recovery resilience and reduction of attack blast radius. Implementing immutable, offline backups with restricted access and regular restore testing ensures data can be recovered even if ransomware encrypts production systems. Deploying Privileged Identity Management with just-in-time access and approval workflows enforces least-privilege and limits standing administrative rights, significantly reducing the ability of ransomware to spread or be deployed using compromised privileged accounts. The other options either do not actively mitigate ransomware risk or contradict security best practices.
$19
Get all 316 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
