SC-100 Practice Test 36 — 15 Questions

Question 1

You are designing a secure access solution for an Azure Kubernetes Service (AKS) cluster that hosts a critical application. You need to ensure that only authorized users can access the Kubernetes API server. Which authentication method should you use?

Accepted Answer

Integrate AKS with Microsoft Entra ID for authentication.. Option B is correct because Microsoft Entra ID integration provides robust authentication and authorization for the AKS API server. Option A is wrong because local accounts (service principal or client certificate) are less secure and do not integrate with identity management. Option C is wrong because Azure RBAC for Kubernetes is authorization, not authentication. Option D is wrong because managed identities are for pod authentication, not for users.

Answer

Use Kubernetes service account tokens.

Answer

Use AKS managed identities for each user.

Answer

Use Azure RBAC for Kubernetes authorization.

Question 2

You are designing a secure data exfiltration protection solution for Azure Storage accounts. You need to prevent data from being copied to unauthorized external locations. Which THREE controls should you implement?

Accepted Answer

Enable Microsoft Defender for Storage and configure alerts for anomalous data extraction.. Option A is correct because NSGs can restrict egress traffic at the subnet level. Option C is correct because Azure Firewall can inspect outbound traffic and block unauthorized destinations. Option E is correct because Microsoft Defender for Storage alerts on anomalous data transfers. Option B is wrong because private endpoints do not prevent exfiltration; they prevent public access. Option D is wrong because soft delete is for recovery, not exfiltration prevention.

Answer

Use Azure Private Endpoints for all storage accounts.

Answer

Enable soft delete and versioning for blobs.

Question 3

Your organization plans to use Microsoft Defender for Cloud to protect hybrid workloads across Azure and on-premises servers. You need to ensure that security policies are consistently applied and that compliance status is monitored centrally. What should you configure?

Accepted Answer

Create Azure Policy initiatives and assign them to management groups and subscriptions.. Option B is correct because Azure Policy allows defining and enforcing security policies across Azure and hybrid environments via Arc-enabled servers. Option A is incorrect because Azure Blueprints are deprecated in favor of deployment stacks. Option C is incorrect because Defender for Cloud's security policies are built on Azure Policy. Option D is incorrect because Azure Security Benchmark is a set of guidelines, not a configuration mechanism.

Answer

Implement Azure Security Benchmark recommendations manually.

Answer

Configure security policies directly in Microsoft Defender for Cloud.

Answer

Deploy Azure Blueprints to assign policies to management groups.

Question 4

Your company uses Microsoft Defender for Cloud to manage security across multiple subscriptions. You need to ensure that all subscriptions have at least one Defender plan enabled, and you want to enforce this centrally using Azure Policy. What is the best approach?

Accepted Answer

Create an Azure Policy that audits subscriptions without any Defender plans and then use a remediation task to enable the required plans.. Option C is correct because Azure Policy can audit if a subscription has no Defender plans enabled, and then use a remediation task to enable the plans. Option A is wrong because Azure Policy cannot directly enable plans without a remediation task. Option B is wrong because Defender for Cloud's continuous export is for security alerts, not policy enforcement. Option D is wrong because Azure Blueprints are being deprecated in favor of Azure Policy and deployment stacks.

Answer

Use the Defender for Cloud continuous export feature to send compliance data to a Log Analytics workspace and create alerts.

Answer

Create an Azure Policy that denies creation of subscriptions that do not have Defender plans enabled.

Answer

Use Azure Blueprints to assign Defender plans to all subscriptions.

Question 5

Your organization uses Microsoft Defender for Cloud to secure a hybrid environment. You need to ensure that security recommendations are automatically remediated for virtual machines. The solution must use Azure Policy and must be deployed at scale. What should you configure?

Accepted Answer

Create a remediation task for the policy that needs auto-remediation. Option C is correct because implementing a remediation task via Azure Policy can automatically remediate non-compliant resources. Defender for Cloud integrates with Azure Policy to allow automatic remediation. Option A is wrong because just assigning a policy initiative does not enable automatic remediation; a remediation task is needed. Option B is wrong because enabling auto-provisioning for Log Analytics deploys the agent, but does not remediate security configurations. Option D is wrong because custom Azure Policy definitions require manual assignment and remediation setup.

Answer

Create a custom Azure Policy definition with deployIfNotExists effect

Answer

Assign a built-in policy initiative to the management group

Answer

Enable auto-provisioning for the Log Analytics agent

Question 6

Your company is implementing a zero-trust network architecture in Azure. You need to ensure that all network traffic between virtual machines is encrypted and authenticated, regardless of the virtual network they reside in. What should you implement?

Accepted Answer

Azure Virtual Network encryption. Option D is correct because Azure Virtual Network encryption encrypts all traffic between VMs within a virtual network, providing zero-trust encryption. Option A is wrong because VPN gateways provide site-to-site encryption, not intra-VNet encryption. Option B is wrong because Azure Firewall does not encrypt traffic. Option C is wrong because NSGs filter traffic but do not encrypt.

Answer

Azure VPN Gateway

Answer

Network Security Groups (NSGs)

Answer

Azure Firewall

Question 7

You need to design a backup and disaster recovery solution for Azure virtual machines that meets a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 1 hour. Which Azure service should you use?

Accepted Answer

Azure Site Recovery. Option B is correct because Azure Site Recovery provides replication with RPO as low as 30 seconds and RTO typically within minutes. Option A is wrong because Azure Backup provides longer RPO and RTO, typically hours. Option C is wrong because Azure VM snapshots are manual. Option D is wrong because Azure managed disks do not provide replication.

Answer

Azure managed disk

Answer

Azure VM snapshot

Answer

Azure Backup

Question 8

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to design a solution to detect brute-force attacks against Azure virtual machines. The solution should use Azure Activity Logs and Windows Security Events. What should you configure in Sentinel?

Accepted Answer

Create a scheduled analytics rule. Option C is correct because Sentinel can ingest Azure Activity Logs and Windows Events, and then use analytics rules to detect brute-force patterns. Option A is wrong because watchlists are for reference data, not detection logic. Option B is wrong because workbooks visualize data, not detect. Option D is wrong because playbooks automate responses, not detect.

Answer

Create a threat intelligence watchlist

Answer

Create a workbook

Answer

Create a playbook

Question 9

You are designing a security solution for an Azure SQL Database that stores sensitive customer data. The solution must encrypt the database at rest and in transit, and also mask sensitive columns from non-privileged users. Which combination of features should you implement?

Accepted Answer

Transparent Data Encryption (TDE) and Dynamic Data Masking (DDM). Option B is correct because Transparent Data Encryption (TDE) encrypts the database at rest, and Dynamic Data Masking (DDM) masks sensitive columns. Option A is wrong because Always Encrypted encrypts columns at the client side, but does not encrypt the database at rest. Option C is wrong because Always Encrypted does not encrypt at rest fully, and TDE plus DDM is the correct combination. Option D is wrong because cell-level encryption is complex and not native to Azure SQL.

Answer

Always Encrypted and Row-Level Security

Answer

Always Encrypted and Dynamic Data Masking (DDM)

Answer

Cell-level encryption and row-level security

Question 10

You are designing a security solution for Azure resources using Azure Policy. You need to ensure that all storage accounts enforce HTTPS traffic and that only certain virtual networks can access them. Which THREE policy effects can you use to achieve this?

Accepted Answer

DeployIfNotExists. Option A, D, and E are correct. Deny prevents creation of non-compliant resources, Audit logs non-compliant resources, and DeployIfNotExists can deploy network rules. Option B is wrong because Append adds to existing resources but not for network rules. Option C is wrong because Modify changes properties, but not suitable for enforcing HTTPS.

Answer

Append

Answer

Modify

Question 11

Your company plans to migrate on-premises servers to Azure. You need to ensure that the migrated servers are protected against malware and vulnerabilities. Which Microsoft Defender for Cloud plan should you enable for the Azure VMs?

Accepted Answer

Microsoft Defender for Servers. Option A is correct because Microsoft Defender for Servers provides malware protection, vulnerability assessment, and threat detection for Azure VMs. Option B is wrong because Defender for Containers is for container workloads. Option C is wrong because Defender for Storage is for storage accounts. Option D is wrong because Defender for SQL is for SQL databases.

Answer

Microsoft Defender for SQL

Answer

Microsoft Defender for Storage

Answer

Microsoft Defender for Containers

Question 12

Which THREE components are required to implement a secure hybrid network architecture using Azure VPN Gateway? (Choose three.)

Accepted Answer

A local network gateway resource in Azure.. Options A, B, and C are correct. A: Local network gateway represents on-premises VPN device. B: Virtual network gateway (VPN Gateway) is the Azure side. C: Connection object ties them together with shared key. Option D is wrong because ExpressRoute is a different connectivity method. Option E is wrong because Azure Firewall is not required for VPN.

Answer

An ExpressRoute circuit.

Answer

An Azure Firewall.

Question 13

Refer to the exhibit. The NSG is applied to a subnet containing a web server. The web server is not receiving HTTP traffic. What is the most likely cause?

Accepted Answer

The sourceAddressPrefix 'Internet' does not include all source IPs. Option B is correct because the rule uses 'Internet' as sourceAddressPrefix, which is a service tag that does not include all public IPs. The actual source IPs may not be covered. Option A is wrong because priority 100 is high enough (lower number = higher priority). Option C is wrong because the rules are correct for inbound traffic. Option D is wrong because the DenyAllOther rule has a higher priority number (1000) than AllowHTTP (100), so it is evaluated after AllowHTTP.

Answer

The DenyAllOther rule has a lower priority than AllowHTTP

Answer

The rule direction is Inbound, but the traffic is outbound

Answer

The priority of the AllowHTTP rule is too low (100)

Question 14

A global company with branches worldwide wants to secure access to Azure resources using a zero-trust approach. They require that all access requests be authenticated, authorized, and encrypted, and that the user's device must be compliant with corporate policies. Which combination of services should they use?

Accepted Answer

Azure AD Conditional Access and Azure AD Application Proxy. Option C is correct because Azure AD Conditional Access can enforce authentication and device compliance, while Azure AD Application Proxy provides secure remote access to on-premises apps without VPN. Option A is wrong because Azure VPN Gateway does not enforce device compliance. Option B is wrong because Azure Firewall does not enforce authentication. Option D is wrong because Azure AD B2C is for external identities, not internal access.

Answer

Azure VPN Gateway and Azure AD Multi-Factor Authentication

Answer

Azure Firewall and Azure AD Password Protection

Answer

Azure AD B2C and Azure AD Identity Protection

Question 15

Refer to the exhibit. You run the PowerShell command against an Azure SQL Database. The command returns a baseline object for rule VA2108. What does this indicate about the database's vulnerability assessment configuration?

Accepted Answer

The security team has approved the current state of rule VA2108 as acceptable. Option C is correct. The presence of a baseline for rule VA2108 means that previous findings for that rule have been approved, so the rule will not be flagged as a vulnerability in future scans. Option A is wrong because it does not mean automatic remediation. Option B is wrong because a baseline is set for specific rules, not all. Option D is wrong because vulnerability assessment is still enabled.

Answer

The vulnerability assessment scan is automatically remediating findings for rule VA2108

Answer

Vulnerability assessment is disabled for this database

Answer

The database has no vulnerability findings