Your company runs a web app on Azure App Service that reads from Azure SQL Database. You need to design access so that the app can connect to the database without storing connection strings in configuration files. The solution must also allow a Conditional Access policy to block access from specific IP ranges. What should you implement?

Create a service principal with a client secret and use it in the connection string

Enable SQL authentication and restrict the database firewall to the App Service outbound IP

Store the SQL connection string in Key Vault and reference it from App Service

Use a system-assigned managed identity for the App Service and grant it database access; enable Azure AD authentication for SQL

A company runs a microservices application on Azure Kubernetes Service (AKS). The application needs to access Azure SQL Database and Azure Storage. The security team wants to avoid storing credentials in the application code and ensure that each service has its own identity. What should you recommend?

Use Kubernetes secrets to store database and storage credentials.

Create a single service principal and use it for all pods.

Use Azure AD Workload Identity for AKS and assign each pod a managed identity that has access to the required resources.

Store connection strings in Azure Key Vault and mount them as secrets in the pods.

What is the purpose of deploying read-only domain controllers (RODCs) in an Active Directory environment?

To synchronize with Microsoft Entra ID

To provide faster authentication for users in remote locations

To allow users to reset their own passwords

To reduce the attack surface in locations with lower physical security

Which Microsoft Entra capability is used to enable business-to-business (B2B) collaboration by allowing external users to access your organization's applications using their own identity?

Microsoft Entra Domain Services

Microsoft Entra B2B collaboration

Microsoft Certified:Cybersecurity Architect Expert

Domain 2Objective 2

Design Solutions for Identity and Access Management SC-100 Practice Questions (Page 5)

Part of the Design security operations, identity, and compliance capabilities domain, which accounts for 25–30% of the SC-100 exam. Microsoft does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–24 in this domain), expect 3–6 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

12concepts

25–30%of the exam

12 Concepts in This Objective

Microsoft Entra Agent ID
Access Management for SaaS
Access Management for PaaS
Access Management for IaaS
Access Management for Hybrid/On-Premises
Access Management for Multicloud
Microsoft Entra ID Solutions
External Identity Solutions
Modern Authentication Strategy
Zero Trust Conditional Access
Active Directory Hardening
Secrets Management

Questions 21–25

21application · medium
Your company runs a web app on Azure App Service that reads from Azure SQL Database. You need to design access so that the app can connect to the database without storing connection strings in configuration files. The solution must also allow a Conditional Access policy to block access from specific IP ranges. What should you implement?
Select an answer first
22application · medium
A company runs a microservices application on Azure Kubernetes Service (AKS). The application needs to access Azure SQL Database and Azure Storage. The security team wants to avoid storing credentials in the application code and ensure that each service has its own identity. What should you recommend?
Select an answer first
23foundation · easy
Which Azure feature provides a secure way to access an IaaS virtual machine's RDP or SSH port without exposing a public IP address?
Select an answer first
24foundation · easy
What is the purpose of deploying read-only domain controllers (RODCs) in an Active Directory environment?
Select an answer first
25foundation · easy
Which Microsoft Entra capability is used to enable business-to-business (B2B) collaboration by allowing external users to access your organization's applications using their own identity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-100

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-100” is a trademark of its owner, used for identification only.

Design Solutions for Identity and Access Management SC-100 Practice Questions (Page 5)

Questions 21–25

Which Azure feature provides a secure way to access an IaaS virtual machine's RDP or SSH port without exposing a public IP address?

What is the purpose of deploying read-only domain controllers (RODCs) in an Active Directory environment?

Which Microsoft Entra capability is used to enable business-to-business (B2B) collaboration by allowing external users to access your organization's applications using their own identity?

Keep studying — Design security operations, identity, and compliance capabilities