SC-100 Practice Test 15 — 15 Questions

Question 1

You are designing a network security architecture for an Azure application that uses Azure Front Door and Azure Application Gateway. The application must be protected from DDoS attacks and common web exploits. Application traffic should be inspected by a web application firewall (WAF) before reaching the backend. What is the recommended deployment order?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Front Door with WAF in front of Azure Application Gateway with WAF.. The recommended deployment order is to place Azure Front Door with WAF at the edge, followed by Azure Application Gateway with WAF before the backend. This provides DDoS protection at the global level via Azure Front Door and regional web application firewall inspection via Application Gateway. Option A is incorrect because it lacks the regional WAF inspection. Option B is incorrect because Azure Front Door without WAF provides no web application firewall protection. Option C is incorrect because Application Gateway with WAF should be behind Front Door for layered defense. Therefore, Option D is correct.

Answer

Azure Front Door with WAF only, no Application Gateway.

Answer

Azure Front Door without WAF in front of Azure Application Gateway without WAF.

Answer

Azure Application Gateway with WAF in front of Azure Front Door.

Question 2

Refer to the exhibit. The NSG is applied to a subnet containing Azure SQL databases. You notice that traffic from the internet to the databases is not being denied. What is the most likely reason?

Accepted Answer

The destinationAddressPrefix should be '*' instead of 'VirtualNetwork'. The Deny rule has destinationAddressPrefix set to 'VirtualNetwork', which only matches traffic destined to IPs within the virtual network. Azure SQL databases are PaaS services with public endpoints; internet traffic does not have a destination in the VNet, so the rule never applies. Changing destinationAddressPrefix to '*' would deny all inbound internet traffic. Option A is incorrect because Allow rules cannot deny traffic. Option C is incorrect because priority 100 is high (lower number = higher priority), so the Deny rule would be evaluated before any lower priority Allow rules. Option D is incorrect because the direction must be Inbound to block incoming traffic.

Answer

The rule should be Allow to deny traffic

Answer

The priority of the Deny rule is too low (100)

Answer

The direction should be Outbound

Question 3

You are designing an API management solution using Azure API Management. The security team requires that all API calls must be authenticated using OAuth 2.0 and that only specific Azure AD applications can access the APIs. Additionally, the solution must support rate limiting and IP filtering. What should you configure?

Accepted Answer

Configure OAuth 2.0 in Azure API Management, use validate-jwt policy to restrict to specific Azure AD apps, and add rate-limit and ip-filter policies. It fully addresses all requirements: it uses OAuth 2.0 with Azure AD for authentication, the 'validate-jwt' policy restricts access to specific Azure AD applications, and the 'rate-limit' and 'ip-filter' policies satisfy the rate limiting and IP filtering requirements. Option A is incorrect because client certificate authentication is not OAuth 2.0. Option B is incorrect because API key authentication is less secure and does not allow restricting to specific Azure AD apps. Option C is incorrect because while it uses OAuth 2.0 and validate-jwt, it does not include the required rate limiting and IP filtering policies.

Answer

Set up client certificate authentication and map certificates to Azure AD apps

Answer

Enable API key authentication and restrict access using subscription keys

Answer

Use OAuth 2.0 with Azure AD and configure inbound policies to validate JWTs

Question 4

Refer to the exhibit. You are reviewing a conditional access policy JSON in Microsoft Entra ID. The policy is enabled but users with the Global Administrator role are not being prompted for MFA. What is the most likely reason?

Accepted Answer

The policy does not include any users except by role.. The Conditional Access policy JSON shows that the 'users' object does not include an 'includeUsers' property for all users or specific groups; instead, users are only included by directory role (e.g., through 'includeRoles'). If the 'includeRoles' array is either empty or does not contain the 'Global Administrator' role, then Global Administrators are not targeted by the policy. Therefore, they are not prompted for MFA despite the policy being enabled. This is the most likely reason because the other options are incorrect: the policy may include applications (option B), the grant control could be set to MFA (not requiring compliant device) (option C), and the policy is enabled (option D).

Answer

The policy does not include any applications.

Answer

The grant control requires a compliant device instead of MFA.

Answer

The policy state is disabled.

Question 5

A company is designing a secure hybrid network architecture. They have an on-premises network connected to Azure via ExpressRoute and a site-to-site VPN as backup. They want to ensure that traffic from Azure to on-premises always uses ExpressRoute when available, but automatically fails over to VPN if ExpressRoute goes down. Which configuration should they implement?

Accepted Answer

Configure BGP on both connections and assign a higher local preference (e.g., 200) to routes learned via ExpressRoute.. BGP local preference is an attribute used to influence outbound traffic from an AS. By assigning a higher local preference (e.g., 200) to routes learned via ExpressRoute, Azure will prefer those routes over VPN routes (which default to local preference 100). This ensures that traffic from Azure to on-premises uses ExpressRoute when available, and automatically fails over to the VPN if the ExpressRoute BGP session drops, as the VPN routes will then be selected.

Answer

Configure the VPN to have a lower BGP weight than ExpressRoute.

Answer

Use both connections in active-active mode with BGP and rely on ECMP.

Answer

Disable BGP on the VPN connection and use static routes with a higher metric for the VPN.

Question 6

Your organization is implementing a secure DevOps pipeline for a critical application. You need to design a solution that scans container images for vulnerabilities before they are deployed to production. Which Azure service should you integrate into the pipeline?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (formerly Azure Security Center) provides integrated vulnerability assessment for container images stored in Azure Container Registry (ACR). When integrated into a DevOps pipeline, Defender for Cloud can scan images on push or on demand, using the Qualys scanner to detect CVEs and generate detailed security reports. This allows the pipeline to block or flag vulnerable images before they reach production, directly addressing the requirement for pre-deployment vulnerability scanning.

Answer

Azure Key Vault

Answer

Azure Policy

Answer

Azure Security Center

Question 7

A company wants to automate incident response in Microsoft 365 Defender. Which THREE actions can be automated using automated investigation and response (AIR) capabilities? (Choose three.)

Accepted Answer

Block a file hash across the organization.. Microsoft 365 Defender's automated investigation and response (AIR) can automatically block a file hash at the tenant level using threat intelligence and cloud-delivered protection. When a malicious file is detected, AIR can create an indicator to block the hash across all endpoints via Microsoft Defender for Endpoint, preventing further execution.

Answer

Reset a user's password.

Answer

Create a new user account.

Question 8

You are designing a security solution for Azure resources. You need to ensure that any changes to network security groups (NSGs) are automatically logged and sent to a central Log Analytics workspace. Which Azure feature should you use?

Accepted Answer

Diagnostic settings on the Azure Activity Log. Diagnostic settings on the Azure Activity Log capture all control-plane operations, including changes to NSGs (e.g., rule additions or deletions). By configuring a diagnostic setting to stream the Activity Log to a Log Analytics workspace, you ensure that every NSG modification is automatically logged and centralized for monitoring and alerting.

Answer

Azure Policy

Answer

NSG flow logs

Answer

Azure Monitor alerts

Question 9

Your organization is implementing Microsoft Intune for mobile device management. You need to design a solution that ensures corporate data on mobile devices is protected if the device is lost or stolen. Which TWO actions should you configure?

Accepted Answer

Configure a compliance policy that requires device encryption. A compliance policy requiring device encryption ensures that if a device is lost or stolen, the data stored on it is unreadable without the decryption key. Intune compliance policies evaluate encryption status (e.g., BitLocker on Windows, FileVault on macOS, or device encryption on iOS/Android) and mark noncompliant devices for conditional access blocking, preventing unauthorized access to corporate data.

Answer

Enforce a minimum PIN length on devices

Answer

Require app protection policies (MAM) for all apps

Answer

Enable jailbreak detection in a device compliance policy

Question 10

A company uses Microsoft Purview to classify data and enforce retention policies. They need to automatically apply a retention label to all documents containing credit card numbers. Which approach should they use?

Accepted Answer

Configure an auto-labeling policy with a sensitive info type. Microsoft Purview auto-labeling policies can automatically apply retention labels to documents based on sensitive info types (SITs), such as credit card numbers. This approach uses pattern matching to detect the credit card number format and applies the label without user intervention, meeting the requirement for automatic enforcement.

Answer

Use a trainable classifier

Answer

Create a manual labeling policy for users

Answer

Use a default label for SharePoint libraries

Question 11

Your organization is required to retain all Microsoft Teams chat messages for 7 years due to regulatory compliance. You need to design a solution that automatically retains and, if needed, e-discovery searches these messages. What should you configure?

Accepted Answer

Microsoft Purview retention policies and eDiscovery. Microsoft Purview retention policies are designed to retain data for a specified period (e.g., 7 years) and can be applied to Microsoft Teams chat messages. eDiscovery (now part of Microsoft Purview eDiscovery) allows authorized users to search, hold, and export retained content for legal or compliance purposes. Together, they meet the regulatory requirement for retention and searchability.

Answer

Microsoft Purview Data Loss Prevention policies

Answer

Azure Policy

Answer

Sensitivity labels auto-labeling

Question 12

A large enterprise is designing a secure infrastructure for a multi-region application deployment. They have a hub-spoke topology in two Azure regions (East US and West US) with VNet peering between the hubs. Each region has a shared services spoke containing Azure AD Domain Services (AAD DS) and management jump boxes. Application spokes in each region host VMs that need to authenticate to the local AAD DS. The company mandates that all traffic between regions must traverse a network virtual appliance (NVA) for inspection, except for Azure management traffic. They also require that all outbound internet traffic from application VMs goes through a single Azure Firewall in the East US hub. They have deployed ExpressRoute to on-premises. Currently, application VMs in West US cannot authenticate to the local AAD DS. What is the most likely cause?

Accepted Answer

The route table for the West US application spoke has a default route (0.0.0.0/0) pointing to the NVA, causing traffic to AAD DS to be sent across regions.. The most likely cause is that the route table for the West US application spoke has a default route (0.0.0.0/0) pointing to the NVA. This forces all outbound traffic, including traffic destined for the local AAD DS (which resides in the same region's shared services spoke), to be routed through the NVA and potentially across regions via the hub peering, rather than staying within the local VNet. Since AAD DS requires low-latency, direct connectivity within the same region, this misrouting prevents authentication.

Answer

The Azure Firewall in East US is not configured to allow traffic from West US to AAD DS.

Answer

The VNet peering between East and West US hubs is not properly configured with 'Allow forwarded traffic' enabled.

Answer

The ExpressRoute circuit is down, causing traffic to be routed over the internet.

Question 13

A company uses Microsoft Defender for Cloud to secure their Azure workloads. They need to ensure that all Azure SQL databases have threat detection enabled. Which TWO actions should they take? (Choose two.)

Accepted Answer

Enable Azure Defender for SQL at the subscription level. The 'SQL servers on machines' plan applies to SQL Server instances on Azure VMs (IaaS), not to Azure SQL Database (PaaS). Option B is correct: enabling Azure Defender for SQL at the subscription level automatically enables threat detection for all Azure SQL databases in that subscription. Option C is incorrect: SQL Vulnerability Assessment identifies vulnerabilities but does not enable threat detection. Option D is correct: enabling Advanced Threat Protection on each SQL server individually also ensures threat detection for all databases on that server, though it is less efficient than subscription-level enablement. Option E is incorrect: SQL auditing is for compliance and auditing, not threat detection.

Answer

Enable Microsoft Defender for Cloud's 'SQL servers on machines' plan

Answer

Configure SQL Vulnerability Assessment

Answer

Configure SQL auditing on each database

Question 14

Your organization is implementing a zero-trust security model. You need to design a solution that continuously verifies user identity, device compliance, and access context before granting access to corporate resources. The solution should also support risk-based policies. Which Microsoft security capability should be at the core of this design?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID Conditional Access is the core policy engine for zero-trust, enabling continuous verification of user identity, device compliance, and access context before granting resource access. It integrates with risk signals from Microsoft Entra ID Protection to enforce risk-based policies, such as requiring multi-factor authentication when sign-in risk is high. This aligns directly with the zero-trust principle of 'never trust, always verify' by evaluating conditions in real time.

Answer

Microsoft Defender for Identity

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 15

You are designing a network security strategy for a multicloud environment that includes Azure and Amazon Web Services (AWS). The company requires that all traffic between the two clouds be encrypted and inspected for threats. You need to recommend a solution that meets the following requirements: - Minimize latency. - Use Microsoft-provided security services where possible. - Ensure traffic is inspected at Layers 3-7. Which TWO options should you include in your design?

Accepted Answer

Azure Virtual WAN with a secured hub that includes Azure Firewall and Firewall Manager.. Azure Virtual WAN with a secured hub integrates Azure Firewall and Firewall Manager to provide a centralized, Microsoft-managed inspection point for traffic between Azure and AWS. This design minimizes latency by routing inter-cloud traffic through Microsoft's global backbone rather than over the public internet, and it supports Layer 3-7 inspection via Azure Firewall's application and network rules. Similarly, on the AWS side, AWS Transit Gateway with AWS Network Firewall provides a centralized, managed inspection point for traffic between VPCs and other connected networks, including inter-cloud traffic. It also minimizes latency by routing traffic through AWS's global infrastructure and supports Layer 3-7 inspection. Together, these two components satisfy all requirements: encrypted and inspected traffic between the two clouds, minimized latency, use of Microsoft-provided services where possible (Azure Firewall), and Layers 3-7 inspection on both sides.

Answer

Azure Firewall with forced tunneling to an on-premises inspection appliance.

Answer

Azure Policy with built-in network security policies.

Answer

Azure Front Door Premium with Web Application Firewall (WAF) policy.