Microsoft SC-100 QUESTIONS AND ANSWERS |
VERIFIED AND WELL DETAILED ANSWERS | PLUS
RATIONALES | GUARANTEED PASS | LATEST EXAM
UPDATE | EXAM PREP | STUDY GUIDE | PRACTICE
TEST
Domain 1: Design a Zero Trust Strategy and Architecture (Questions 1-30)
,1. A company wants to implement a Zero Trust security model. Which principle should be the foundation of their
strategy?
A) Trust but verify
B) Assume breach
C) Perimeter-based security
D) Implicit trust for internal network traffic
Answer: B
Rationale: The core principles of Zero Trust are: Verify explicitly, Use least privilege access, and Assume
breach. "Assume breach" is a foundational mindset shift from traditional perimeter security.
2. An organization is moving to a hybrid cloud model. They need to ensure that only compliant and healthy
devices can access corporate applications, regardless of location. Which Zero Trust pillar does this primarily
address?
A) Identities
B) Devices
C) Applications
D) Network
,Answer: B
Rationale: The "Devices" pillar of Zero Trust focuses on device health and compliance as a condition for access.
This ensures that access is granted only from trusted and compliant endpoints.
3. You are designing a Zero Trust architecture. You need to provide just-in-time (JIT) and just-enough-access
(JEA) privileges for administrators to manage Azure resources. What should you use?
A) Azure AD Privileged Identity Management (PIM)
B) Azure Firewall
C) Network Security Groups (NSGs)
D) Azure Policy
Answer: A
Rationale: Azure AD PIM provides JIT privileged access, requiring approval and multi-factor authentication for
administrative roles, which aligns with the principle of least privilege.
4. A company wants to verify explicitly for every access request. Which of the following signals should be part of
their verification process?
A) User identity and location
B) Device health and compliance
, C) Data sensitivity and application being accessed
D) All of the above
Answer: D
Rationale: "Verify explicitly" means using all available data points to make an access decision. This includes
user identity, location, device health, service or workload, data classification, and anomalies.
5. Your organization is adopting a Zero Trust model. You need to recommend a solution to enforce adaptive
access policies based on user risk and sign-in risk. What should you recommend?
A) Azure AD Conditional Access
B) Azure Sentinel
C) Microsoft Defender for Identity
D) Azure Bastion
Answer: A
Rationale: Azure AD Conditional Access is the policy engine for Zero Trust. It uses signals like user risk, sign-in
risk, device state, and location to enforce access controls.
6. What is the primary goal of a Zero Trust network architecture?
VERIFIED AND WELL DETAILED ANSWERS | PLUS
RATIONALES | GUARANTEED PASS | LATEST EXAM
UPDATE | EXAM PREP | STUDY GUIDE | PRACTICE
TEST
Domain 1: Design a Zero Trust Strategy and Architecture (Questions 1-30)
,1. A company wants to implement a Zero Trust security model. Which principle should be the foundation of their
strategy?
A) Trust but verify
B) Assume breach
C) Perimeter-based security
D) Implicit trust for internal network traffic
Answer: B
Rationale: The core principles of Zero Trust are: Verify explicitly, Use least privilege access, and Assume
breach. "Assume breach" is a foundational mindset shift from traditional perimeter security.
2. An organization is moving to a hybrid cloud model. They need to ensure that only compliant and healthy
devices can access corporate applications, regardless of location. Which Zero Trust pillar does this primarily
address?
A) Identities
B) Devices
C) Applications
D) Network
,Answer: B
Rationale: The "Devices" pillar of Zero Trust focuses on device health and compliance as a condition for access.
This ensures that access is granted only from trusted and compliant endpoints.
3. You are designing a Zero Trust architecture. You need to provide just-in-time (JIT) and just-enough-access
(JEA) privileges for administrators to manage Azure resources. What should you use?
A) Azure AD Privileged Identity Management (PIM)
B) Azure Firewall
C) Network Security Groups (NSGs)
D) Azure Policy
Answer: A
Rationale: Azure AD PIM provides JIT privileged access, requiring approval and multi-factor authentication for
administrative roles, which aligns with the principle of least privilege.
4. A company wants to verify explicitly for every access request. Which of the following signals should be part of
their verification process?
A) User identity and location
B) Device health and compliance
, C) Data sensitivity and application being accessed
D) All of the above
Answer: D
Rationale: "Verify explicitly" means using all available data points to make an access decision. This includes
user identity, location, device health, service or workload, data classification, and anomalies.
5. Your organization is adopting a Zero Trust model. You need to recommend a solution to enforce adaptive
access policies based on user risk and sign-in risk. What should you recommend?
A) Azure AD Conditional Access
B) Azure Sentinel
C) Microsoft Defender for Identity
D) Azure Bastion
Answer: A
Rationale: Azure AD Conditional Access is the policy engine for Zero Trust. It uses signals like user risk, sign-in
risk, device state, and location to enforce access controls.
6. What is the primary goal of a Zero Trust network architecture?
