SC-100 Practice Test 38 — 15 Questions

Question 1

Your organization is planning to use Azure Bastion for secure RDP/SSH access to Azure VMs. You need to ensure that Bastion can reach the VMs in a spoke virtual network that is connected to a hub via VNet peering. The hub has an Azure Firewall. What is the minimal configuration required?

Accepted Answer

Deploy Azure Bastion in the hub VNet. Ensure the spoke VNet is peered to the hub VNet.. Option D is correct because Azure Bastion does not require public IPs on VMs nor does it need to traverse the firewall; it uses private IPs and the Bastion host in the same or peered VNet. Option A is wrong because VMs do not need public IPs with Bastion. Option B is wrong because Bastion does not need to go through the firewall; it uses direct private IP connectivity. Option C is wrong because Bastion does not need a public IP on the VM.

Answer

Assign a public IP address to each VM. Deploy Azure Bastion in the hub VNet.

Answer

Deploy Azure Bastion in the spoke VNet. Configure Azure Firewall to allow traffic from Bastion to the VMs.

Answer

Deploy Azure Bastion in the hub VNet. Ensure the spoke VNet has a route to the Bastion subnet.

Question 2

Your organization is designing a Microsoft Sentinel workspace for a multi-region deployment. You need to optimize cost while ensuring that security data is available for investigation in the primary region. Which TWO actions should you take?

Accepted Answer

Use a single Sentinel workspace in the primary region and ingest data from all regions via diagnostic settings.. Option A is correct because using a single workspace across regions avoids duplicate data ingestion and cost. Option C is correct because using Azure Lighthouse allows centralized management across regions. Option B is wrong because multiple workspaces increase cost and management overhead. Option D is wrong because it doesn't directly address cost optimization. Option E is wrong because separate workspaces increase cost.

Answer

Enable Azure Monitor Agent (AMA) with data collection rules to filter logs.

Answer

Use Log Analytics clusters with dedicated clusters to reduce costs.

Answer

Deploy Sentinel workspaces in each region and use cross-workspace queries.

Question 3

A multinational corporation uses Microsoft Entra ID for identity and Microsoft Defender for Cloud Apps for SaaS app governance. The security team wants to deploy a conditional access policy that blocks access from untrusted locations for all cloud apps except Microsoft 365, which should only be blocked if the device is not compliant. How should you configure the policy?

Accepted Answer

Create two conditional access policies: one for all cloud apps except Microsoft 365 blocking untrusted locations, and one for Microsoft 365 requiring compliant device.. Option D is correct because you can use two policies: one targeting 'All cloud apps' blocking untrusted locations (excluding Microsoft 365), and another targeting 'Office 365' requiring compliant device. Option A is incorrect because a single policy cannot have different conditions for different apps. Option B is incorrect because session controls are for monitoring, not blocking. Option C is incorrect because blocking access would be too restrictive.

Answer

Use a session policy in Defender for Cloud Apps to monitor non-compliant devices.

Answer

Create one conditional access policy that includes all cloud apps and requires compliant device for Microsoft 365 only.

Answer

Configure a conditional access policy that blocks access from untrusted locations for all apps.

Question 4

You are designing a secure access strategy for a manufacturing plant using Azure IoT Hub and Azure Defender for IoT. The plant has unpatched legacy PLCs that cannot be updated. What is the best approach to prevent these devices from being compromised and used as an entry point into the corporate network?

Accepted Answer

Implement network micro-segmentation using Azure Firewall and NSGs to isolate the PLCs from the corporate network.. Option D is correct because micro-segmentation with network security groups (NSGs) and Azure Firewall isolates the legacy devices, limiting lateral movement. Option A is wrong because unpatched devices cannot be hardened with Defender for IoT agents. Option B is wrong because TLS is often not supported on legacy PLCs. Option C is wrong because VPN would expose the devices to more traffic.

Answer

Use Azure VPN Gateway to connect PLCs to the virtual network.

Answer

Install the Microsoft Defender for IoT micro-agent on each PLC.

Answer

Enforce TLS 1.2 for all PLC communications.

Question 5

Your company uses Microsoft Sentinel as a SIEM. You need to ensure that all Azure subscription activity logs are ingested into Sentinel. What is the most efficient way to configure this?

Accepted Answer

Enable the 'Azure Activity' data connector in Sentinel.. Option B is correct because the data connector for Azure Activity is designed for this purpose. Option A is wrong because manual export is not efficient. Option C is wrong because diagnostic settings export to a Log Analytics workspace, but Sentinel requires the data connector. Option D is wrong because Logic Apps are unnecessary overhead.

Answer

Configure diagnostic settings on the subscription to send logs to a Log Analytics workspace.

Answer

Create an Azure Logic App to periodically pull activity logs.

Answer

Manually export activity logs to a storage account and connect to Sentinel.

Question 6

Refer to the exhibit. You are reviewing a Bicep template for deploying an Azure SQL Database server. Which security best practice is violated?

Accepted Answer

Administrator password is hardcoded in plain text.. Option D is correct because hardcoding passwords in code is a security risk. Option A is wrong because publicNetworkAccess is disabled. Option B is wrong because TLS version is set to 1.2. Option C is wrong because Azure SQL does not require Azure AD auth by default.

Answer

Minimal TLS version is set to 1.2, which is acceptable.

Answer

Public network access is disabled, which may affect connectivity.

Answer

Azure AD authentication is not configured.

Question 7

A company uses Azure Arc to manage on-premises servers. The security team wants to enforce that all servers (on-premises and Azure) have Microsoft Defender for Endpoint installed and running. Which solution should you use to ensure compliance across hybrid environments?

Accepted Answer

Azure Policy with Guest Configuration. Option C is correct because Azure Policy with Guest Configuration can audit and enforce configurations on Azure Arc-enabled servers. Option A is wrong because Microsoft Intune manages mobile devices and PCs, not servers. Option B is wrong because Microsoft Defender for Cloud provides security recommendations but cannot enforce configuration compliance. Option D is wrong because Azure Update Manager focuses on patching, not endpoint protection enforcement.

Answer

Microsoft Intune

Answer

Azure Update Manager

Answer

Microsoft Defender for Cloud

Question 8

Refer to the exhibit. The NSG is applied to a subnet containing Azure SQL databases. You notice that traffic from the internet to the databases is not being denied. What is the most likely reason?

Accepted Answer

The destinationAddressPrefix should be '*' instead of 'VirtualNetwork'. Option C is correct because the destinationAddressPrefix is 'VirtualNetwork', but SQL databases are not in a virtual network by default; they are PaaS services with a public endpoint. Option A is wrong because priority 100 is high. Option B is wrong because the rule explicitly denies traffic. Option D is wrong because the direction is inbound.

Answer

The rule should be Allow to deny traffic

Answer

The priority of the Deny rule is too low (100)

Answer

The direction should be Outbound

Question 9

Which TWO of the following are features of Azure DDoS Protection?

Accepted Answer

Cost protection for scaled resources during an attack. Option B is correct because DDoS Protection provides adaptive tuning and mitigation. Option D is correct because it offers cost protection for scaled resources during an attack. Option A is wrong because DDoS Protection does not provide a web application firewall (WAF is separate). Option C is wrong because DDoS Protection does not provide SSL termination. Option E is wrong because DDoS Protection is not a VPN service.

Answer

Web application firewall (WAF) capabilities

Answer

Site-to-site VPN connectivity

Answer

SSL termination and offloading

Question 10

You are designing a network security solution for a multi-tier application in Azure that must meet PCI DSS compliance. You need to restrict traffic between tiers to only necessary ports and protocols. You also need to log all denied traffic for auditing. What is the most efficient design?

Accepted Answer

Deploy Azure Firewall in a hub virtual network. Use application rules to allow specific FQDNs between tiers. Enable diagnostic logs and send them to a Log Analytics workspace.. Option A is correct because Azure Firewall with application rules provides L7 filtering, and diagnostic logs capture denied traffic. Option B is wrong because NSGs lack L7 filtering and logging of denied traffic is not as comprehensive. Option C is wrong because Application Gateway is a load balancer, not a firewall for inter-tier traffic. Option D is wrong because NVAs add complexity and cost without clear benefit over Azure Firewall for this use case.

Answer

Deploy Azure Application Gateway in front of each tier. Use WAF policies to filter traffic.

Answer

Use network security groups (NSGs) on each subnet to allow/deny traffic by IP and port. Enable NSG flow logs for auditing.

Answer

Deploy a third-party NVA (e.g., Palo Alto) in the hub. Configure inter-tier routing through the NVA.

Question 11

You are designing a secure remote access solution for employees using Windows 10/11 devices that are managed by Microsoft Intune. The solution must enforce device compliance before allowing access to corporate resources and must support single sign-on (SSO). Which technology should you use?

Accepted Answer

Use Microsoft Entra ID with Conditional Access policies that require compliant devices.. Option B is correct because Microsoft Entra ID with Conditional Access can evaluate device compliance from Intune and provide SSO. Option A is incorrect because VPN alone does not enforce device compliance. Option C is incorrect because Microsoft Defender for Endpoint is an endpoint protection solution, not an access control mechanism. Option D is incorrect because Azure AD Application Proxy is for on-prem apps, but it does not natively enforce device compliance without Conditional Access.

Answer

Deploy a traditional VPN with certificate-based authentication.

Answer

Set up Azure AD Application Proxy for remote access.

Answer

Implement Microsoft Defender for Endpoint to block non-compliant devices.

Question 12

Your company uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate Exchange Online mailboxes. Which conditional access policy setting should you configure?

Accepted Answer

Grant: Require device to be marked as compliant.. Option B is correct because the 'Require device to be marked as compliant' grant condition enforces compliance. Option A is wrong because requiring multifactor authentication does not check device compliance. Option C is wrong because requiring Intune enrollment is part of compliance but not the compliance state itself. Option D is wrong because approved client app is for app protection policies.

Answer

Grant: Require approved client app.

Answer

Grant: Require multifactor authentication.

Answer

Grant: Require Intune enrollment.

Question 13

Which TWO actions should you take to protect Azure Virtual Machines from ransomware attacks? (Choose two.)

Accepted Answer

Enable Azure Backup for all VMs.. Options A and C are correct. Option A: Backups (Azure Backup) are essential for recovery. Option C: Antimalware (Microsoft Defender Antivirus) helps prevent infection. Option B is wrong because disabling public RDP reduces attack surface but is not specific to ransomware. Option D is wrong because Azure Firewall is for network segmentation, not direct ransomware protection. Option E is wrong because auto-shutdown does not prevent ransomware.

Answer

Configure Azure Firewall to block all outbound traffic.

Answer

Use auto-shutdown schedules for VMs.

Answer

Disable RDP access from the internet.

Question 14

Your organization has a multi-region Azure deployment with ExpressRoute connections to on-premises. You need to design a solution that ensures all traffic between on-premises and Azure is inspected by a firewall for both inbound and outbound connections. The solution must minimize latency and avoid a single point of failure. What design should you recommend?

Accepted Answer

Deploy Azure Firewall in each region with forced tunneling enabled. Option D is correct because deploying Azure Firewall in each region in an active-active configuration with forced tunneling provides inspection for all traffic without a single point of failure. Option A is wrong because a single firewall is a single point of failure and adds latency for all traffic. Option B is wrong because NSGs do not inspect traffic, they filter based on rules. Option C is wrong because a third-party NVA in a single hub introduces a single point of failure and potential licensing complexity.

Answer

Deploy Azure Firewall in one central hub region and route all traffic through it

Answer

Use Network Security Groups (NSGs) on subnets to filter traffic

Answer

Deploy a third-party NVA in a hub-and-spoke topology with a single hub

Question 15

Your company uses Azure DevOps to deploy infrastructure. You need to ensure that all deployed resources have specific tags for cost tracking. Which Azure policy effect should you use to prevent deployment of untagged resources?

Accepted Answer

Deny. Option B is correct because the 'Deny' effect prevents creation of non-compliant resources. Option A is wrong because 'Audit' only logs compliance, does not block. Option C is wrong because 'DeployIfNotExists' can add tags after creation but does not prevent deployment. Option D is wrong because 'Disabled' turns off the policy.

Answer

Disabled

Answer

DeployIfNotExists

Answer

Audit