SC-100 Practice Test 28 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure resources. The security team wants to ensure that all virtual machines are covered by Defender for Cloud's vulnerability assessment capabilities. Which plan must be enabled?

Accepted Answer

Microsoft Defender for Servers Plan 2. Option D is correct because the Defender for Servers Plan 2 includes the integrated vulnerability assessment powered by Qualys or Microsoft Defender Vulnerability Management. Option A is wrong because Defender CSPM covers cloud security posture management but not VM-specific vulnerability assessment. Option B is wrong because Defender for Cloud Apps (now part of Defender XDR) focuses on SaaS applications. Option C is wrong because Defender for Storage protects storage accounts.

Answer

Microsoft Defender for Storage

Answer

Microsoft Defender for Cloud Apps

Answer

Defender Cloud Security Posture Management (CSPM)

Question 2

You are designing a secure hybrid network architecture for a company that uses Azure and an on-premises datacenter. The company requires that all traffic between Azure and on-premises traverses Microsoft's backbone network and never the public internet. Additionally, the solution must provide automatic failover if the primary connection fails. Which Azure service should you include in the design?

Accepted Answer

Azure ExpressRoute with redundant circuits. Azure ExpressRoute with redundant circuits meets the requirement of using Microsoft's backbone and automatic failover. VPN Gateway uses the public internet. Azure Virtual WAN can use ExpressRoute but is not a direct answer. Azure Front Door is for global load balancing of web applications.

Answer

Azure Virtual WAN

Answer

Azure Front Door

Answer

Azure VPN Gateway

Question 3

Your company uses Azure Firewall to filter outbound traffic from a virtual network. You need to allow only HTTP and HTTPS traffic to specific FQDNs, while blocking all other outbound traffic. Which Azure Firewall rule type should you use?

Accepted Answer

Application rule. Option D is correct because application rules allow filtering based on FQDNs for HTTP/HTTPS. Option A is wrong because network rules filter by IP/port, not FQDN. Option B is wrong because NAT rules only translate addresses. Option C is wrong because threat intelligence rules block known malicious IPs.

Answer

NAT rule

Answer

Threat intelligence rule

Answer

Network rule

Question 4

Your organization uses Microsoft Defender for Cloud to assess security posture. You need to design a solution that automatically applies a security baseline to new Azure VMs. Which feature should you use?

Accepted Answer

Azure Policy with Guest Configuration. Option D is correct because Azure Policy with Guest Configuration can apply security baselines to VMs at scale. Option A is wrong because Defender for Cloud provides recommendations but does not automatically apply baselines. Option B is wrong because Azure Automation State Configuration (DSC) can apply configurations but Azure Policy is more integrated. Option C is wrong because Azure Update Management handles patching, not baselines.

Answer

Microsoft Defender for Cloud regulatory compliance dashboard

Answer

Azure Update Management

Answer

Azure Automation State Configuration (DSC)

Question 5

You are designing a secure access solution for an on-premises application that uses legacy authentication protocols. The organization plans to migrate to Microsoft Entra ID but the application vendor has not yet provided a modern authentication update. The solution must enable single sign-on (SSO) and support multifactor authentication (MFA) for this application without modifying the application code. Which approach should you recommend?

Accepted Answer

Deploy Microsoft Entra Application Proxy with pre-authentication. Option C is correct because Microsoft Entra Application Proxy allows publishing on-premises apps with legacy authentication, and it can integrate with Entra ID for pre-authentication, enabling SSO and MFA without code changes. Option A is wrong because Entra ID Conditional Access policies require modern authentication to enforce MFA. Option B is wrong because the Microsoft Authentication Library (MSAL) requires app code changes. Option D is wrong because federation with ADFS still requires modern auth at the app level.

Answer

Integrate the application with the Microsoft Authentication Library (MSAL)

Answer

Federate the on-premises Active Directory with Microsoft Entra ID

Answer

Use Microsoft Entra Conditional Access policies to require MFA

Question 6

A multinational corporation is designing a secure access solution for remote employees using company-managed devices. The solution must enforce device compliance before granting access to corporate resources, support single sign-on (SSO) for SaaS applications, and provide conditional access policies based on risk. Which combination of Microsoft security products should you recommend?

Accepted Answer

Microsoft Intune + Microsoft Entra ID + Microsoft Defender for Cloud Apps. Microsoft Intune provides device compliance, Microsoft Entra ID provides SSO and conditional access, and Microsoft Defender for Cloud Apps provides risk-based access control. The other combinations miss key components.

Answer

Microsoft Intune + Microsoft Defender for Endpoint + Microsoft Sentinel

Answer

Microsoft Entra ID + Microsoft Defender for Cloud Apps + Microsoft Purview

Answer

Microsoft Configuration Manager + Microsoft Entra ID + Microsoft Defender for Identity

Question 7

Refer to the exhibit. You are reviewing an ARM template for an Azure App Service configuration. What is the effect of the ipSecurityRestrictions array?

Accepted Answer

It allows traffic from 192.168.0.0/24 and denies all other traffic.. The rules are evaluated in priority order. The first rule allows traffic from 192.168.0.0/24. The second rule denies all other traffic (Any). This effectively restricts access to only the specified corporate IP range. The order matters because if the deny rule had lower priority, it would block the allowed range.

Answer

It allows all traffic because the deny rule has a higher priority number.

Answer

It denies traffic from 192.168.0.0/24 and allows all other traffic.

Answer

It denies all traffic because the deny rule covers any IP.

Question 8

You are designing a secure hybrid network architecture that connects an on-premises data center to Azure. The requirements include: encrypted traffic, high availability across two Azure regions, and automatic failover. You need to recommend a connectivity solution that meets these requirements. What should you use?

Accepted Answer

Azure ExpressRoute with VPN gateway failover. Option D is correct because ExpressRoute with VPN gateway failover provides encrypted connectivity with high availability and automatic failover across regions. Option A is wrong because Site-to-Site VPN alone may not meet high availability requirements. Option B is wrong because ExpressRoute alone does not encrypt traffic by default. Option C is wrong because Point-to-Site VPN is for individual clients, not site-to-site.

Answer

Azure Point-to-Site VPN

Answer

Azure Site-to-Site VPN with active-passive configuration

Answer

Azure ExpressRoute with Microsoft Peering

Question 9

A company uses Azure Front Door to publish a web application globally. They need to protect against DDoS attacks and web application attacks (SQL injection, XSS). Which two services should they enable in combination?

Accepted Answer

Azure DDoS Protection Standard and Azure WAF policy on Front Door. Azure DDoS Protection protects against volumetric DDoS attacks. Azure Web Application Firewall (WAF) in Front Door protects against application-layer attacks. Azure Firewall is for network-layer filtering. Network Security Groups (NSGs) are for subnet-level filtering. Azure DDoS Protection Standard is the correct tier.

Answer

Azure DDoS Protection Standard and Azure Firewall

Answer

Azure WAF on Application Gateway and Network Security Groups

Answer

Azure Firewall and Azure DDoS Protection Basic

Question 10

You are designing a secure hybrid network connectivity solution between an on-premises datacenter and Azure. The requirement is to have encrypted traffic and high availability. Which service should you use?

Accepted Answer

Azure VPN Gateway. Option C is correct because VPN Gateway provides encrypted site-to-site VPN with active-active configuration for high availability. Option A is wrong because ExpressRoute offers private connectivity but encryption is optional. Option B is wrong because Azure Bastion is for RDP/SSH access. Option D is wrong because Azure Front Door is a global load balancer.

Answer

Azure Front Door

Answer

Azure ExpressRoute

Answer

Azure Bastion

Question 11

Your company uses Microsoft Intune to manage devices. You need to design a solution that prevents users from installing unauthorized applications on corporate Windows 10 devices. Which Intune policy should you configure?

Accepted Answer

Device restriction policy (Windows 10). Option A is correct because Intune device restriction policies can block installation of apps from untrusted sources. Option B is wrong because app protection policies apply to managed apps, not device-wide installation. Option C is wrong because compliance policies assess device state but do not block installation. Option D is wrong because configuration policies set settings but not app installation control.

Answer

Compliance policy

Answer

App protection policy (MAM)

Answer

Configuration policy (OMA-URI)

Question 12

Your organization uses Microsoft Intune to manage endpoints. The security team wants to ensure that devices that cannot be enrolled in Intune (e.g., unmanaged BYOD devices) are still subject to security policies when accessing corporate resources. Which Microsoft Entra ID feature should you use?

Accepted Answer

Microsoft Entra Conditional Access policies. Option B is correct because Microsoft Entra Conditional Access policies can enforce access controls based on device compliance, including requiring MFA or blocking access from unmanaged devices. Option A is wrong because Intune enrollment is only for managed devices. Option C is wrong because Microsoft Defender for Endpoint (now part of Defender XDR) provides threat detection but not access policy enforcement. Option D is wrong because Windows Defender Application Control is for code integrity on managed devices.

Answer

Microsoft Intune enrollment policies

Answer

Windows Defender Application Control

Answer

Microsoft Defender for Endpoint

Question 13

Your organization is implementing a zero-trust network strategy. You need to ensure that all network traffic between Azure virtual machines is encrypted and authenticated at the IP layer, regardless of the virtual network they are in. Which Azure feature should you configure?

Accepted Answer

Azure Virtual Network encryption. Azure Virtual Network encryption provides IPsec encryption for traffic between VMs within the same virtual network or peered virtual networks. Service endpoints use public IPs. Private Link is for accessing PaaS services privately. VPN Gateway is for site-to-site.

Answer

Azure Service Endpoints

Answer

Azure VPN Gateway

Answer

Azure Private Link

Question 14

Refer to the exhibit. You run the PowerShell script to apply an NSG to a subnet. However, connectivity tests show that the NSG rule is not being applied. What is the most likely reason?

Accepted Answer

The script is missing the Set-AzVirtualNetwork call after updating the subnet.. Option D is correct because after modifying the subnet configuration with Set-AzVirtualNetworkSubnetConfig, you must apply the changes using Set-AzVirtualNetwork to update the VNet. Without that, the NSG association is not saved. Option A is wrong because the NSG is created and associated to the subnet, but the VNet update is missing. Option B is wrong because the priority is valid. Option C is wrong because the NSG is applied to the subnet, not the NIC.

Answer

The NSG was not associated to the subnet; Set-AzVirtualNetworkSubnetConfig does not associate the NSG.

Answer

The rule priority 100 conflicts with an existing rule with lower priority.

Answer

The NSG should be associated to the network interface instead of the subnet.

Question 15

Your company uses Azure Virtual Machines (VMs) running Windows Server. You need to ensure that only approved applications can run on the VMs. Which Azure security feature should you use?

Accepted Answer

Azure Policy with application control. Option C is correct because Azure Policy with application control can enforce allowed applications. Option A is wrong because Microsoft Defender for Cloud provides threat detection but not application whitelisting. Option B is wrong because Azure Firewall is a network firewall. Option D is wrong because Just-in-Time VM access controls remote access, not applications.

Answer

Azure Firewall

Answer

Microsoft Defender for Cloud

Answer

Just-in-Time VM access