SC-100 Practice Exam 2 — 20 Questions

Question 1

A company uses Microsoft Defender for Cloud to assess compliance with Azure Security Benchmark (ASB). The security team wants to ensure that all recommendations are being followed. Which three actions should the team take to manage and remediate recommendations effectively?

Accepted Answer

Enable continuous export of compliance data to Log Analytics or Event Hubs.. Option A is correct because enabling continuous export of compliance data to Log Analytics or Event Hubs allows the security team to centralize, query, and monitor compliance data over time. This is essential for tracking the status of all Azure Security Benchmark recommendations, creating custom alerts, and integrating with SIEM or automation workflows, rather than relying on manual checks.

Answer

Manually remediate all high-severity recommendations each month.

Answer

Disable recommendations that are not applicable to the environment.

Question 2

Order the steps to configure Azure Policy to enforce tagging on resources.

Question 3

A company uses Azure Firewall to inspect outbound traffic from a hub virtual network. They need to ensure that traffic from a spoke virtual network to a specific SaaS application (api.contoso.com) bypasses the firewall for performance reasons. What is the most efficient way to achieve this?

Accepted Answer

Add a user-defined route (UDR) in the spoke virtual network's route table with destination api.contoso.com and next hop type 'Internet'.. Option B is correct because adding a user-defined route (UDR) with destination api.contoso.com and next hop type 'Internet' in the spoke virtual network's route table forces traffic destined for that FQDN to bypass the Azure Firewall and go directly to the internet. This is the most efficient approach as it avoids firewall inspection for performance-sensitive traffic without requiring any firewall rule changes.

Answer

Configure an application rule in Azure Firewall with a 'Bypass' action for api.contoso.com.

Answer

Enable service endpoints for Microsoft.Storage in the spoke subnet.

Answer

Create a network rule in Azure Firewall to allow traffic to api.contoso.com and deny all other traffic.

Question 4

A company deploys Azure Bastion in a VNet. They want to allow a security engineer to connect to a Windows VM in a peered VNet using Azure Bastion. The engineer can see the VM in the portal but cannot connect. Which configuration is most likely missing?

Accepted Answer

The peered VNet does not have 'Allow Azure Bastion Communication' enabled on the peering connection.. Azure Bastion requires the 'Allow Azure Bastion Communication' setting to be enabled on the peering connection for the peered VNet. Without this, the Bastion service cannot route traffic to the target VM in the peered VNet, even though the VM is visible in the portal. This setting allows the Bastion's control plane and data plane to communicate across the peering link.

Answer

The Azure Bastion subnet size is /28.

Answer

The VM's subnet does not have an inbound NSG rule allowing RDP (3389) from the Azure Bastion subnet.

Answer

The VM does not have Azure AD authentication enabled.

Question 5

Order the steps to deploy Azure Firewall with forced tunneling in a hub virtual network.

Question 6

Which TWO actions should you take to secure an Azure Kubernetes Service (AKS) cluster?

Accepted Answer

Enable Azure AD integration for Kubernetes RBAC.. Option A is correct because integrating Azure AD with AKS enables Kubernetes RBAC to use Azure AD identities for authentication and authorization. This allows you to grant granular permissions to users, groups, or service principals based on their Azure AD roles, eliminating the need for static Kubernetes secrets and providing centralized identity management.

Answer

Disable HTTP application routing.

Answer

Enable Azure Firewall to restrict outbound traffic.

Answer

Use a service principal for AKS cluster authentication and store the secret in a Kubernetes secret.

Question 7

Order the steps to configure Azure DDoS Protection Standard for a virtual network.

Question 8

Order the steps to implement Azure AD Privileged Identity Management (PIM) for a role.

Question 9

Order the steps to troubleshoot an Azure VPN gateway connection failure.

Question 10

A company is designing a data protection strategy for Azure SQL Database. They need to ensure that backups are retained for 7 years to meet regulatory compliance. Which Azure feature should they use?

Accepted Answer

Long-Term Retention (LTR). Long-Term Retention (LTR) for Azure SQL Database allows you to retain full database backups for up to 10 years, which meets the 7-year regulatory compliance requirement. LTR is specifically designed for archival and compliance scenarios, storing backups in separate containers with configurable retention policies based on weekly, monthly, or yearly intervals.

Answer

Geo-redundant backup storage

Answer

Point-in-Time Restore

Answer

Active Geo-Replication

Question 11

Order the steps to configure Azure Key Vault firewall and virtual network service endpoints.

Question 12

A company is designing a secure hybrid network architecture. They have an on-premises network connected to Azure via ExpressRoute and a site-to-site VPN as backup. They want to ensure that traffic from Azure to on-premises always uses ExpressRoute when available, but automatically fails over to VPN if ExpressRoute goes down. Which configuration should they implement?

Accepted Answer

Configure BGP on both connections and assign a higher local preference (e.g., 200) to routes learned via ExpressRoute.. Option D is correct because BGP local preference is an attribute used to influence outbound traffic from an AS. By assigning a higher local preference (e.g., 200) to routes learned via ExpressRoute, Azure will prefer those routes over VPN routes (which default to local preference 100). This ensures that traffic from Azure to on-premises uses ExpressRoute when available, and automatically fails over to the VPN if the ExpressRoute BGP session drops, as the VPN routes will then be selected.

Answer

Configure the VPN to have a lower BGP weight than ExpressRoute.

Answer

Use both connections in active-active mode with BGP and rely on ECMP.

Answer

Disable BGP on the VPN connection and use static routes with a higher metric for the VPN.

Question 13

A company deploys a three-tier application with web servers, application servers, and database servers in a VNet. They need to ensure that web servers can only communicate with application servers on port 443, and application servers can only communicate with database servers on port 1433. Web servers should not be able to communicate with database servers. What is the most secure and efficient way to implement this?

Accepted Answer

Place each tier in a separate subnet, and create NSGs on each subnet with appropriate inbound and outbound rules.. Option A is correct because placing each tier in a separate subnet and applying Network Security Groups (NSGs) with specific inbound and outbound rules provides network segmentation and granular traffic control. NSGs are stateful, so you can define rules that allow web servers to initiate outbound traffic to application servers on port 443 and application servers to initiate outbound traffic to database servers on port 1433, while implicitly denying all other cross-tier communication (including web-to-database). This approach is both secure and efficient as it uses native Azure constructs without additional cost or complexity.

Answer

Use Azure Firewall to inspect all traffic between tiers.

Answer

Use Application Security Groups (ASGs) to group VMs, but do not create NSGs.

Answer

Place all tiers in the same subnet, and use a single NSG with rules to allow and deny traffic.

Question 14

A company uses Azure Policy to enforce that all storage accounts must have HTTPS traffic only. They assign a built-in policy to audit this setting. A developer creates a new storage account with HTTP enabled, and the policy reports it as non-compliant. What should the company do to automatically remediate this violation?

Accepted Answer

Create a new policy assignment with a 'deployIfNotExists' effect that enables HTTPS-only.. Option D is correct because the 'deployIfNotExists' effect in Azure Policy can automatically remediate non-compliant resources by deploying a configuration (such as enabling HTTPS-only) when the policy detects a violation. This effect runs a remediation task that modifies the resource to meet the policy requirement, eliminating the need for manual intervention. In this scenario, it would automatically enable HTTPS traffic on the storage account, bringing it into compliance.

Answer

Enable Azure Security Center's just-in-time access for storage accounts.

Answer

Change the policy effect to 'Deny' to prevent creation of non-compliant storage accounts.

Answer

Ask the developer to manually enable HTTPS-only on the storage account.

Question 15

Which THREE components are required to implement a secure hybrid network with Azure using a site-to-site VPN?

Accepted Answer

VPN gateway (route-based). A route-based VPN gateway (option C) is required for site-to-site VPN connections because it uses dynamic routing (BGP) and supports IKEv2, enabling automatic failover and policy-based traffic selectors. This is essential for secure hybrid networking as it allows Azure to route traffic to on-premises networks via the VPN tunnel without static route limitations.

Answer

Public IP address for the VPN device

Answer

ExpressRoute circuit

Question 16

A company deploys Azure App Service with a custom domain and SSL certificate. They want to enforce HTTPS only. Which configuration setting should they enable?

Accepted Answer

HTTPS Only. The 'HTTPS Only' setting in Azure App Service enforces that all incoming requests are redirected from HTTP to HTTPS, ensuring encrypted communication. This is achieved by returning a 301 redirect for any HTTP request, which aligns with the requirement to enforce HTTPS only.

Answer

Client Certificates

Answer

Minimum TLS Version

Answer

Custom Domain

Question 17

A company uses Azure Storage for sensitive data. They need to ensure that data is encrypted at rest and that encryption keys are managed by the customer (Customer-Managed Keys). Which THREE actions are required?

Accepted Answer

Create an Azure Key Vault to store the customer-managed key. Option B is correct because customer-managed keys (CMK) for Azure Storage encryption must be stored in an Azure Key Vault, which provides a secure, centralized repository for managing cryptographic keys. Without a Key Vault, the customer cannot control or rotate the encryption keys used by Storage Service Encryption (SSE).

Answer

Enable double encryption

Answer

Enable Azure Information Protection

Question 18

A company is designing a microservices architecture on Azure Kubernetes Service (AKS). They need to secure communication between services using mutual TLS (mTLS). Which solution should they implement?

Accepted Answer

Istio service mesh. Istio service mesh is the correct solution because it provides a dedicated infrastructure layer for managing service-to-service communication, including automatic mutual TLS (mTLS) between microservices. Istio injects Envoy sidecar proxies into each pod, which handle encryption, authentication, and authorization without requiring application code changes. This enables zero-trust network security within the AKS cluster.

Answer

Azure Application Gateway

Answer

Azure Firewall

Answer

Azure API Management

Question 19

A company is designing a data classification strategy for their Azure environment. They need to identify sensitive data stored in Azure SQL Database. Which TWO solutions should they consider?

Accepted Answer

Azure SQL Data Discovery & Classification. Azure SQL Data Discovery & Classification is correct because it is a native feature of Azure SQL Database that automatically discovers, classifies, and labels sensitive columns (e.g., credit card numbers, PII) directly within the database engine. It provides a built-in dashboard for auditing and monitoring classification status, making it the primary tool for identifying sensitive data stored in Azure SQL Database.

Answer

Azure Information Protection

Answer

Azure Purview

Answer

Azure Policy

Question 20

A company uses Azure Policy to enforce compliance. They have a custom policy that denies creation of storage accounts without encryption enabled. A developer reports that they cannot create a storage account even though they specified encryption. What is the most likely cause?

Accepted Answer

The policy's 'then' block uses 'deny' but the condition logic evaluates the 'encryption' property incorrectly. Option C is correct because the most likely cause is that the policy's condition logic incorrectly evaluates the 'encryption' property. Azure Policy uses JSON-based condition expressions to check resource properties; if the condition does not match the actual property path (e.g., 'properties.encryption.enabled' vs. 'properties.encryption') or uses an incorrect operator, the deny effect will trigger even when encryption is specified. This is a common misconfiguration in custom policies.

Answer

The developer does not have 'Microsoft.Authorization/policyAssignments/write' permission

Answer

The policy effect is set to 'audit' instead of 'deny'

Answer

The policy is scoped to a management group that includes the developer's subscription