SC-100 Zero Trust & Threat Protection Solutions 3 — Questions and Answers
Question 1: Which Azure AD feature detects risky sign-ins and user behaviors such as impossible travel and leaked credentials, supporting Zero Trust identity verification?
- Azure AD Privileged Identity Management
- Azure AD Identity Protection (Correct answer)
- Azure AD Access Reviews
- Azure AD B2C
Correct answer: Azure AD Identity Protection
Azure AD Identity Protection uses Microsoft's threat intelligence to detect risky users and sign-ins, triggering risk-based Conditional Access policies.
Question 2: A company must protect its Azure workloads from network-layer DDoS attacks. Which service provides adaptive tuning and attack analytics at the platform level?
- Azure Firewall Premium
- Azure DDoS Protection Standard (Correct answer)
- Azure Front Door WAF
- Microsoft Sentinel
Correct answer: Azure DDoS Protection Standard
Azure DDoS Protection Standard provides adaptive tuning, attack telemetry, and guaranteed SLA-backed mitigation for volumetric and protocol DDoS attacks on Azure resources.
Question 3: In a Zero Trust architecture, which concept ensures users and workloads are granted only the permissions needed to perform their current task?
- Assume breach
- Verify explicitly
- Use least privilege access (Correct answer)
- Defense in depth
Correct answer: Use least privilege access
Least privilege access, one of Zero Trust's core principles, limits permissions to only what is necessary, reducing the blast radius if credentials are compromised.
Question 4: Which Microsoft Sentinel feature uses built-in ML to detect multi-stage attacks by correlating low-fidelity alerts into high-confidence incidents?
- Playbooks
- Fusion detection (Correct answer)
- Workbooks
- Hunting queries
Correct answer: Fusion detection
Microsoft Sentinel's Fusion engine uses ML to correlate multiple low-severity alerts across data sources into high-fidelity multi-stage attack incidents.
Question 5: An architect needs to protect privileged admin accounts from lateral movement. Which Zero Trust control specifically limits the window during which elevated permissions are active?
- Azure AD Conditional Access
- Azure AD Privileged Identity Management (PIM) with just-in-time access (Correct answer)
- Microsoft Defender for Identity
- Azure Policy
Correct answer: Azure AD Privileged Identity Management (PIM) with just-in-time access
PIM with just-in-time access grants elevated permissions only when needed and for a limited time, minimizing the exposure window for privileged accounts.
Question 6: Which Microsoft Defender for Identity detection identifies when an attacker performs reconnaissance by enumerating domain users via LDAP or SAMR protocols?
- Pass-the-hash detection
- Account enumeration reconnaissance (Correct answer)
- Golden Ticket attack detection
- Lateral movement path detection
Correct answer: Account enumeration reconnaissance
Microsoft Defender for Identity detects account enumeration reconnaissance by monitoring LDAP and SAMR queries used to map out user accounts in the domain.
Question 7: A Zero Trust design requires that all internal network traffic between microservices be authenticated and encrypted. Which Azure service provides mutual TLS (mTLS) for service-to-service communication?
- Azure API Management
- Azure Service Mesh (Open Service Mesh / Istio add-on for AKS) (Correct answer)
- Azure Application Gateway
- Azure VPN Gateway
Correct answer: Azure Service Mesh (Open Service Mesh / Istio add-on for AKS)
Azure's service mesh implementation (such as the Istio add-on for AKS) provides automatic mTLS between microservices, enabling Zero Trust east-west traffic authentication.
SC-100 Zero Trust & Threat Protection Solutions 3
Which Azure AD feature detects risky sign-ins and user behaviors such as impossible travel and leaked credentials, supporting Zero Trust identity verification?