SC-100 Practice Test 35 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing an Azure Policy definition. What will this policy do when assigned to a subscription?

Accepted Answer

Prevent creation of virtual machines with OS disks that are not Premium SSD.. Option A is correct because the policy denies creation of VMs whose OS disk is not Premium_LRS. Option B is wrong because it only denies if the OS disk type is not Premium_LRS, not all VMs. Option C is wrong because it checks OS disk, not data disks. Option D is wrong because it evaluates at creation time.

Answer

Deny creation of all virtual machines.

Answer

Audit existing virtual machines for compliance.

Answer

Enforce Premium SSD on data disks.

Question 2

You are designing a privileged access solution for your Azure infrastructure. You need to ensure that just-in-time (JIT) access is required for all administrative actions on Azure VMs. What should you configure?

Accepted Answer

Just-in-time VM access in Microsoft Defender for Cloud. Option B is correct because Microsoft Defender for Cloud's JIT VM access provides time-bound access to VMs. Option A is incorrect because PIM is for role-based access, not VM access. Option C is incorrect because Azure Bastion provides secure RDP/SSH but not JIT. Option D is incorrect because NSGs alone do not enforce JIT.

Answer

Microsoft Entra Privileged Identity Management (PIM) for Azure VM roles

Answer

Network security groups with service tags

Answer

Azure Bastion with Conditional Access

Question 3

Your organization uses Microsoft Purview to classify sensitive data in Azure storage. You need to ensure that a file containing PII is automatically protected when uploaded to an Azure Blob Storage account. What should you use?

Accepted Answer

Microsoft Purview Data Policy with auto-labeling. Option A is correct because Purview Data Policy can enforce auto-labeling and protection based on classification. Option B is incorrect because sensitivity labels alone do not trigger protection automatically. Option C is incorrect because Azure Information Protection is now part of Purview. Option D is incorrect because retention labels are for retention, not protection.

Answer

Microsoft Purview retention labels

Answer

Microsoft Purview Information Protection sensitivity labels manually applied

Answer

Azure Information Protection unified labeling client

Question 4

Your organization is designing a hybrid identity infrastructure with Microsoft Entra ID. You need to ensure that users can access on-premises applications using passwordless authentication and that the solution minimizes latency for authentication requests. What should you implement?

Accepted Answer

Use Microsoft Entra application proxy to publish the on-premises applications and enable passwordless authentication.. Option C is correct because Microsoft Entra application proxy provides secure remote access to on-premises web applications without requiring a VPN, and it can leverage passwordless authentication through Microsoft Entra ID. Option A is wrong because VPN introduces latency and does not inherently support passwordless. Option B is wrong because Microsoft Entra Domain Services is for domain-joined VMs, not for publishing apps. Option D is wrong because Web Application Proxy is a legacy on-premises component that does not integrate with passwordless.

Answer

Join the on-premises servers to Microsoft Entra Domain Services and use passwordless authentication.

Answer

Install Web Application Proxy (WAP) on-premises and integrate with Microsoft Entra ID for passwordless.

Answer

Deploy a VPN and use Microsoft Entra ID with passwordless sign-in.

Question 5

Refer to the exhibit. You run the PowerShell command to retrieve information about a Managed HSM in Azure. The output shows that the HSM is in 'Provisioned' state and has two security domains. What is the purpose of the security domains?

Accepted Answer

To back up and restore the HSM's key material and configuration.. Option A is correct because Managed HSM security domains are used to back up the HSM's key material for disaster recovery. Option B is wrong because HSM pools are for standard Key Vault, not Managed HSM. Option C is wrong because private endpoints are configured separately. Option D is wrong because security domains are not for RBAC; RBAC is managed via Azure RBAC.

Answer

To manage the HSM's private endpoint connections.

Answer

To enable role-based access control (RBAC) for the HSM.

Answer

To define the HSM's network access and firewall rules.

Question 6

Your company is designing a secure baseline for Azure Linux virtual machines using Azure Policy. You need to ensure that all Linux VMs have SSH access restricted, disk encryption enabled, and vulnerability assessments installed. Which THREE built-in policies should you assign? (Choose THREE.)

Accepted Answer

[Preview]: Configure Linux VMs to install the Azure Security Agent for vulnerability assessment. Options A, B, and D are correct. A restricts SSH from the internet, B enables encryption, and D deploys vulnerability assessment. Option C is wrong because it requires Microsoft Antimalware, which is for Windows. Option E is wrong because it enforces Windows Defender Credential Guard, which is Windows-specific.

Answer

Microsoft Antimalware for Azure must be configured with automatic update

Answer

Windows Defender Credential Guard should be enabled on Windows VMs

Question 7

Your company is designing a hybrid identity solution using Microsoft Entra ID. You need to ensure that users can access on-premises applications using modern authentication methods. The solution must support multi-factor authentication and Conditional Access policies. What should you implement?

Accepted Answer

Microsoft Entra application proxy. Option B is correct because Microsoft Entra application proxy provides secure remote access to on-premises web applications without requiring a VPN. It supports modern authentication, MFA, and Conditional Access. Option A is wrong because Microsoft Entra Connect is for directory synchronization, not application publishing. Option C is wrong because Azure AD Domain Services provides domain services like LDAP, not application proxy. Option D is wrong because Microsoft Intune is for device management, not application access.

Answer

Microsoft Entra Connect

Answer

Azure AD Domain Services

Answer

Microsoft Intune

Question 8

Your organization is implementing Microsoft Defender for Identity to protect on-premises Active Directory. Which THREE activities does Defender for Identity monitor?

Accepted Answer

Privilege escalation attempts. Option A, C, and D are correct. Defender for Identity monitors lateral movement paths, reconnaissance attacks, and privilege escalation. Option B is wrong because file integrity monitoring is a feature of Defender for Servers or Azure Policy. Option E is wrong because network traffic to internet is monitored by Defender for Network or network security groups.

Answer

File integrity changes on domain controllers

Answer

Network traffic to external IP addresses

Question 9

Your organization is planning to deploy a new web application on Azure VMs. The security team requires that all incoming traffic to the VMs be inspected by a network virtual appliance (NVA) before reaching the VMs. Which Azure networking solution should you use to route traffic through the NVA?

Accepted Answer

User Defined Routes (UDRs). Option B is correct because User Defined Routes (UDRs) allow you to override Azure's default routing to force traffic through an NVA. Option A is wrong because Azure Firewall is a managed firewall service, not a routing mechanism. Option C is wrong because Azure Load Balancer distributes traffic but does not enforce routing through an NVA. Option D is wrong because NSGs filter traffic but do not route it.

Answer

Azure Firewall

Answer

Azure Load Balancer

Answer

Network Security Groups (NSGs)

Question 10

Your organization uses Microsoft Sentinel to monitor security events. You need to design a solution that alerts when a user account is created and then used to log in from a different country within 1 hour. Which KQL query structure should you use?

Accepted Answer

Use a join operation on AccountName with a time window. Option C is correct because a join operation on AccountName and a time window can correlate account creation and login events. Option A is wrong because a simple filter cannot correlate two events. Option B is wrong because a union just combines tables, no correlation. Option D is wrong because a summarize with timechart shows aggregation, not specific account correlation.

Answer

Use a single table filter with where clause

Answer

Use summarize with timechart

Answer

Use union to combine events

Question 11

Which THREE of the following are best practices for designing a secure hybrid network architecture with Azure?

Accepted Answer

Use Azure Bastion for secure VM access without public IPs. Option A is correct because using ExpressRoute with Azure Firewall provides secure, dedicated connectivity and inspection. Option B is correct because forcing tunneling ensures all internet-bound traffic goes through the firewall for inspection. Option C is correct because Azure Bastion eliminates the need for public IPs on VMs. Option D is wrong because opening all ports to a management subnet violates least privilege. Option E is wrong because a single VPN gateway is a single point of failure.

Answer

Open all ports to a management subnet for ease of administration

Answer

Use a single VPN gateway for all regions

Question 12

Your organization is deploying Microsoft Defender for Cloud to secure a hybrid environment with workloads in Azure and on-premises. You need to ensure that all servers are covered by Defender for Cloud's plans. Which two actions should you take?

Accepted Answer

Install the Azure Connected Machine agent (Azure Arc) on on-premises servers.. Option A is correct because enabling the appropriate Defender plans (e.g., Servers) on the Azure subscription covers Azure VMs. Option C is correct because deploying the Azure Arc agent on on-premises servers allows them to be managed by Defender for Cloud. Option B is wrong because enabling just the foundational CSPM doesn't include the server-specific protections. Option D is wrong because Defender for Cloud doesn't require Azure Monitor agents for basic coverage, though it's recommended for advanced features.

Answer

Enable only the foundational cloud security posture management (CSPM) on the subscription.

Answer

Deploy the Azure Monitor Agent to all on-premises servers.

Question 13

Your company uses Microsoft Sentinel for security operations. You need to detect brute-force attacks against Azure VMs by correlating failed sign-in events from multiple sources. Which data connector should you enable?

Accepted Answer

Windows Security Events via AMA (Azure Monitor Agent) connector.. Option C is correct because Windows Security Events via AMA can collect failed sign-in events (Event ID 4625) from Azure VMs. Option A is wrong because Azure Activity logs do not contain VM sign-in events. Option B is wrong because Azure AD sign-in logs are for cloud applications, not VM sign-ins. Option D is wrong because Syslog is for Linux VMs but the question does not specify OS.

Answer

Azure Active Directory (now Microsoft Entra ID) sign-in logs connector.

Answer

Syslog connector.

Answer

Azure Activity log connector.

Question 14

You are designing a backup strategy for Azure virtual machines using Azure Backup. The solution must support cross-region restore and provide 10 years of retention for compliance. Which THREE features should you enable? (Choose THREE.)

Accepted Answer

Cross-Region Restore. Options A, C, and E are correct. Cross-Region Restore (A) enables restoring to a paired region. Archive Tier (C) allows retention up to 10 years. Immutable vault (E) prevents deletion of backups. Option B is wrong because Azure Site Recovery is for disaster recovery, not backup retention. Option D is wrong because soft delete is for accidental deletion protection, not for long-term retention.

Answer

Azure Site Recovery replication

Answer

Soft Delete

Question 15

You are designing a network security solution for a multi-tier application hosted in Azure. The front-end web tier must be accessible from the internet, but the back-end database tier must only accept traffic from the front-end tier. Which Azure service should you use to enforce this restriction?

Accepted Answer

Network Security Groups (NSGs). Option A is correct because Network Security Groups (NSGs) can be used to filter traffic between subnets. By applying an NSG to the database subnet with a rule allowing inbound traffic only from the front-end subnet's IP range, you restrict access. Option B is wrong because Azure Firewall is a managed firewall service, but for simple subnet-level filtering, NSGs are more appropriate and cost-effective. Option C is wrong because Application Gateway is a layer 7 load balancer. Option D is wrong because Azure Bastion provides secure RDP/SSH access to VMs.

Answer

Azure Firewall

Answer

Azure Bastion

Answer

Application Gateway

SC-100 Practice Test 35 — 15 Questions

Exhibit

SC-100 Practice Test 35 — 15 Questions

Exhibit