SC-100 Practice Test 3 — 10 Questions

Question 1

A company uses Microsoft Defender for Cloud to assess compliance with Azure Security Benchmark (ASB). The security team wants to ensure that all recommendations are being followed. Which three actions should the team take to manage and remediate recommendations effectively?

Accepted Answer

Enable continuous export of compliance data to Log Analytics or Event Hubs.. Option A is correct because enabling continuous export of compliance data to Log Analytics or Event Hubs allows the security team to centralize, query, and monitor compliance data over time. This is essential for tracking the status of all Azure Security Benchmark recommendations, creating custom alerts, and integrating with SIEM or automation workflows, rather than relying on manual checks.

Answer

Manually remediate all high-severity recommendations each month.

Answer

Disable recommendations that are not applicable to the environment.

Question 2

Order the steps to configure Azure Policy to enforce tagging on resources.

Question 3

A company uses Azure Firewall to inspect outbound traffic from a hub virtual network. They need to ensure that traffic from a spoke virtual network to a specific SaaS application (api.contoso.com) bypasses the firewall for performance reasons. What is the most efficient way to achieve this?

Accepted Answer

Add a user-defined route (UDR) in the spoke virtual network's route table with destination api.contoso.com and next hop type 'Internet'.. Option B is correct because adding a user-defined route (UDR) with destination api.contoso.com and next hop type 'Internet' in the spoke virtual network's route table forces traffic destined for that FQDN to bypass the Azure Firewall and go directly to the internet. This is the most efficient approach as it avoids firewall inspection for performance-sensitive traffic without requiring any firewall rule changes.

Answer

Configure an application rule in Azure Firewall with a 'Bypass' action for api.contoso.com.

Answer

Enable service endpoints for Microsoft.Storage in the spoke subnet.

Answer

Create a network rule in Azure Firewall to allow traffic to api.contoso.com and deny all other traffic.

Question 4

A company deploys Azure Bastion in a VNet. They want to allow a security engineer to connect to a Windows VM in a peered VNet using Azure Bastion. The engineer can see the VM in the portal but cannot connect. Which configuration is most likely missing?

Accepted Answer

The peered VNet does not have 'Allow Azure Bastion Communication' enabled on the peering connection.. Azure Bastion requires the 'Allow Azure Bastion Communication' setting to be enabled on the peering connection for the peered VNet. Without this, the Bastion service cannot route traffic to the target VM in the peered VNet, even though the VM is visible in the portal. This setting allows the Bastion's control plane and data plane to communicate across the peering link.

Answer

The Azure Bastion subnet size is /28.

Answer

The VM's subnet does not have an inbound NSG rule allowing RDP (3389) from the Azure Bastion subnet.

Answer

The VM does not have Azure AD authentication enabled.

Question 5

Order the steps to deploy Azure Firewall with forced tunneling in a hub virtual network.

Question 6

Which TWO actions should you take to secure an Azure Kubernetes Service (AKS) cluster?

Accepted Answer

Enable Azure AD integration for Kubernetes RBAC.. Option A is correct because integrating Azure AD with AKS enables Kubernetes RBAC to use Azure AD identities for authentication and authorization. This allows you to grant granular permissions to users, groups, or service principals based on their Azure AD roles, eliminating the need for static Kubernetes secrets and providing centralized identity management.

Answer

Disable HTTP application routing.

Answer

Enable Azure Firewall to restrict outbound traffic.

Answer

Use a service principal for AKS cluster authentication and store the secret in a Kubernetes secret.

Question 7

Order the steps to configure Azure DDoS Protection Standard for a virtual network.

Question 8

Order the steps to implement Azure AD Privileged Identity Management (PIM) for a role.

Question 9

Order the steps to troubleshoot an Azure VPN gateway connection failure.

Question 10

A company is designing a data protection strategy for Azure SQL Database. They need to ensure that backups are retained for 7 years to meet regulatory compliance. Which Azure feature should they use?

Accepted Answer

Long-Term Retention (LTR). Long-Term Retention (LTR) for Azure SQL Database allows you to retain full database backups for up to 10 years, which meets the 7-year regulatory compliance requirement. LTR is specifically designed for archival and compliance scenarios, storing backups in separate containers with configurable retention policies based on weekly, monthly, or yearly intervals.

Answer

Geo-redundant backup storage

Answer

Point-in-Time Restore

Answer

Active Geo-Replication