SC-100 Practice Test 40 — 15 Questions

Question 1

Your company plans to use Microsoft Defender for Cloud to protect its Azure resources. You need to enable just-in-time (JIT) VM access to reduce the attack surface. Which TWO configurations are required to implement JIT access?

Accepted Answer

Enable JIT VM access in Microsoft Defender for Cloud.. Option B is correct because JIT access requires enabling it in Defender for Cloud for the VMs. Option D is correct because JIT access requires an Azure Policy to enforce the JIT configuration. Option A is wrong because a network security group (NSG) is used, but it is not a separate requirement; JIT automatically configures NSG rules. Option C is wrong because Azure Bastion is a separate service for secure RDP/SSH access, not required for JIT. Option E is wrong because a Log Analytics workspace is used for monitoring, but not required for JIT.

Answer

Deploy Azure Bastion for secure RDP/SSH connectivity.

Answer

Configure a Log Analytics workspace to collect JIT logs.

Answer

Create a network security group (NSG) that allows all inbound traffic.

Question 2

Your company has a Microsoft 365 E5 subscription and uses Microsoft Defender for Office 365. You need to protect users from phishing attacks that use malicious links in email messages. The solution should allow users to report suspicious emails to the security team for analysis. You also want to automatically block repeated phishing attempts from the same sender. What should you configure?

Accepted Answer

Configure Safe Links policies and enable the Report Message add-in for user reporting.. Option B is correct because Safe Links protects users from clicking malicious links in real time, and the user reporting add-in allows reporting. Attack simulation training helps educate users but is not the primary protection mechanism. Option A is wrong because only the reporting add-in does not protect against links. Option C is wrong because Safe Attachments protects attachments, not links. Option D is wrong because anti-spam policies are for spam, not phishing links.

Answer

Configure anti-spam policies and enable the Report Message add-in.

Answer

Configure Safe Attachments policies and enable the Report Message add-in.

Answer

Enable the Report Message add-in for Outlook and configure a mailbox for submissions.

Question 3

Your organization is adopting a Zero Trust security model. You need to design a solution for secure remote access to on-premises applications that eliminates VPNs. Which TWO Microsoft technologies should you use?

Accepted Answer

Microsoft Entra Application Proxy. Option C (Microsoft Entra Application Proxy) provides secure remote access to on-premises apps without VPN. Option E (Microsoft Defender for Cloud Apps) provides conditional access and session control. Option A (Azure VPN Gateway) is VPN; Option B (Azure Bastion) is for RDP/SSH to VMs; Option D (Microsoft Intune) is for device management.

Answer

Azure Bastion

Answer

Microsoft Intune

Answer

Azure VPN Gateway

Question 4

You are designing a secure CI/CD pipeline for deploying infrastructure as code (ARM templates) to Azure. The solution must detect drift from the desired state and prevent deployment of non-compliant resources. Which THREE Azure services should you incorporate?

Accepted Answer

Azure Blueprints. Correct answers: A, B, D. Azure Policy can evaluate compliance before deployment, Azure Blueprints (or its replacement, deployment stacks) define the desired state, and Azure DevOps pipelines can run pre-deployment checks. Option C is incorrect: Azure Resource Graph is for querying resources, not enforcing. Option E is incorrect: Azure Monitor is for monitoring, not drift detection.

Answer

Azure Monitor

Answer

Azure Resource Graph

Question 5

Your organization is planning to deploy Microsoft Defender for Cloud to protect a hybrid environment that includes on-premises servers and Azure virtual machines. You need to ensure that the security recommendations and threat detections are consistently applied across all resources. What should you configure?

Accepted Answer

Enable auto-provisioning for the Log Analytics agent on all subscriptions.. Option A is correct because enabling auto-provisioning for the Log Analytics agent ensures that all existing and future VMs (both on-premises and Azure) are automatically monitored and security recommendations are applied consistently. Option B is wrong because Azure Arc is for managing on-premises machines, but it does not by itself provide consistent security policy application. Option C is wrong because just assigning a policy does not enforce monitoring. Option D is wrong because Azure Policy is used to enforce compliance, but it does not replace the need for auto-provisioning.

Answer

Connect on-premises servers using Azure Arc and assign a built-in policy initiative.

Answer

Configure an Azure Policy to require the deployment of the Log Analytics agent.

Answer

Use Azure Policy to assign the 'Deploy Log Analytics agent' initiative to the management group.

Question 6

Your organization uses Microsoft Sentinel for security operations. You need to design a solution to detect and respond to lateral movement attempts using pass-the-hash attacks. Which TWO data sources should you enable in Microsoft Sentinel to best detect this activity?

Accepted Answer

Windows Security Events via Azure Monitor Agent. Option A (Windows Security Events) logs NTLM authentication events that can reveal pass-the-hash attempts. Option D (Microsoft Defender for Identity) provides advanced behavioral analytics to detect lateral movement. Option B (Azure Activity) is for Azure resource operations, not on-premises lateral movement. Option C (Office 365) is for cloud app activity. Option E (DNS) helps with network detection but is not the best for pass-the-hash.

Answer

Office 365 Audit Logs

Answer

DNS query logs

Answer

Azure Activity Log

Question 7

A company wants to secure its Azure Kubernetes Service (AKS) cluster. They need to ensure that pods cannot communicate with each other unless explicitly allowed, and that secrets are encrypted at rest. Which TWO security controls should they implement?

Accepted Answer

Use Azure Key Vault with Secrets Store CSI driver for secret management.. Correct answers: A and C. Network policies in Kubernetes can restrict pod-to-pod communication, and Azure Key Vault with CSI driver allows secrets to be encrypted and stored externally. Option B is incorrect: Azure AD integration is for authentication, not network or encryption. Option D is incorrect: Azure Policy can enforce image source, not pod communication. Option E is incorrect: Container insights is for monitoring.

Answer

Apply Azure Policy to restrict container image sources.

Answer

Enable Container insights for monitoring.

Answer

Enable Azure AD integration for the AKS cluster.

Question 8

Your company uses Azure Firewall to secure outbound traffic from a hub virtual network that contains multiple spoke virtual networks. You need to implement a solution that allows traffic from specific spoke VMs to reach a specific external SaaS endpoint, while blocking all other outbound traffic. The SaaS endpoint uses a dynamic set of IP addresses that change frequently. What should you do?

Accepted Answer

Configure Azure Firewall application rules using FQDN tags to allow traffic to the SaaS endpoint.. Option B is correct because using Azure Firewall with fully qualified domain name (FQDN) tags allows you to allow traffic to a specific SaaS endpoint by its FQDN, even if IP addresses change dynamically. Option A is wrong because network rules based on IP addresses cannot handle dynamic IP changes. Option C is wrong because service tags are used for Azure services, not external SaaS endpoints. Option D is wrong because Azure Firewall Manager is for managing multiple firewalls, not for solving dynamic IP filtering.

Answer

Configure Azure Firewall network rules to allow traffic to the SaaS endpoint's current IP range.

Answer

Deploy Azure Firewall Manager and enable threat intelligence-based filtering.

Answer

Use Azure Firewall service tags to allow traffic to the SaaS endpoint.

Question 9

Your organization uses Azure SQL Database for a sensitive financial application. You need to implement a defense-in-depth strategy to protect the database. The requirements are: (1) All connections to the database must be encrypted in transit. (2) Only specific Azure services and on-premises IP ranges should be allowed to connect. (3) Database administrators should be able to view the database schema but not the actual data. (4) Auditing must be enabled for all data access. What combination of features should you implement?

Accepted Answer

Enforce TLS 1.2, configure firewall rules, enable Dynamic Data Masking, and enable auditing.. Option D is correct because: (1) Enforce TLS 1.2 ensures encryption in transit. (2) Firewall rules restrict access by IP. (3) Dynamic Data Masking hides sensitive data from admins. (4) Auditing logs data access. Option A is wrong because Always Encrypted encrypts data at rest and in use but does not restrict network access. Option B is wrong because VNet service endpoints provide network isolation but do not enforce TLS. Option C is wrong because Azure AD authentication does not restrict network access or mask data.

Answer

Enable VNet service endpoints and firewall rules, and require Azure AD authentication.

Answer

Configure firewall rules, enable Azure AD authentication, and enable auditing.

Answer

Enable Always Encrypted, configure firewall rules, and enable auditing.

Question 10

Your company is deploying Microsoft Sentinel in a government agency that requires strict data residency. You need to ensure that all Sentinel data is stored within the United States. Which THREE actions must you take to meet this requirement?

Accepted Answer

Disable cross-region replication in the Log Analytics workspace settings.. Option A (Select workspace region) is critical because data is stored in the region where the Log Analytics workspace is created. Option B (Enable customer-managed keys) is required for compliance in many government scenarios. Option D (Disable cross-region data replication) ensures data does not replicate outside the US. Option C (Enable data export) would send data elsewhere. Option E (Use Azure Policy) can enforce, but it's not a direct data residency action.

Answer

Configure data export to a storage account in a different region for redundancy.

Answer

Use Azure Policy to audit workspace region for compliance.

Question 11

Your company is planning to use Azure Policy to enforce security compliance across multiple subscriptions. You need to define a set of policies that will be applied to all subscriptions. Which THREE components should you include in your policy assignment?

Accepted Answer

Parameters.. Option A is correct because policy definitions are the rules that enforce compliance. Option C is correct because assignment scope defines where the policy applies (e.g., management group, subscription). Option D is correct because parameters allow customization of policy definitions at assignment time. Option B is wrong because initiative definitions are groups of policies, but the question asks for components of a single policy assignment; an initiative is a separate artifact. Option E is wrong because remediation tasks are actions taken after assignment, not part of the assignment itself.

Answer

Initiative definition.

Answer

Remediation task.

Question 12

You are designing a secure infrastructure for an Azure Kubernetes Service (AKS) cluster that will host sensitive workloads. Which TWO configurations should you implement to secure the cluster?

Accepted Answer

Enable Azure AD integration for role-based access control (RBAC).. Option A is correct because enabling Azure AD integration allows you to use Azure AD identities for cluster authentication. Option C is correct because using pod identity allows pods to authenticate to Azure resources securely. Option B is wrong because cluster autoscaler scales nodes, not security. Option D is wrong because Azure Monitor provides monitoring, not security. Option E is wrong because the HTTP application routing add-on is for ingress, not security.

Answer

Enable Azure Monitor for containers.

Answer

Enable the HTTP application routing add-on.

Answer

Enable the cluster autoscaler.

Question 13

Your company has an Azure subscription that contains multiple virtual machines (VMs) running Windows Server. You need to ensure that all VMs are compliant with your organization's security baseline. The security baseline includes specific registry key settings, password policies, and service configurations. You want to continuously monitor and automatically remediate non-compliant VMs. What should you implement?

Accepted Answer

Use Azure Policy with Guest Configuration extension to audit and remediate the VM settings.. Option A is correct because Azure Policy with Guest Configuration extension allows you to audit and remediate settings inside VMs, including registry keys and services. Option B is wrong because Azure Automation State Configuration is for DSC, but it requires more manual setup and does not integrate natively with Azure Policy for compliance. Option C is wrong because Microsoft Defender for Cloud provides security recommendations but not granular configuration remediation. Option D is wrong because Azure Update Manager focuses on patching, not configuration.

Answer

Deploy Azure Automation State Configuration to apply Desired State Configuration (DSC) to the VMs.

Answer

Use Azure Update Manager to ensure VMs are up to date.

Answer

Enable Microsoft Defender for Cloud and review the security recommendations.

Question 14

Your organization is migrating from on-premises Active Directory to Microsoft Entra ID. You need to design a solution for hybrid identity that supports seamless SSO for legacy applications that require Kerberos authentication. Which THREE components should you include in your design?

Accepted Answer

Register legacy applications as Enterprise Applications in Microsoft Entra ID. Option A (Microsoft Entra Connect) enables synchronization and seamless SSO. Option C (Password hash sync) is required for seamless SSO. Option D (Enterprise App registration) allows legacy apps to use Microsoft Entra ID for authentication. Option B (AD FS) is optional and not required; Option E (Azure AD Application Proxy) is for remote access, not Kerberos SSO.

Answer

Deploy Azure AD Application Proxy to publish legacy apps

Answer

Active Directory Federation Services (AD FS) deployed on-premises

Question 15

Your organization uses Microsoft Intune to manage iOS and Android devices. You need to ensure that corporate data on these devices is protected in case the device is lost or stolen. The security policy requires that corporate data be automatically removed from the device when it is reported lost, while personal data remains intact. The devices are enrolled in Intune with user affinity. What should you configure?

Accepted Answer

Configure a selective wipe (retire) action that can be triggered via a Power Automate flow when a device is reported lost through a custom app.. Option C uses selective wipe, which removes only corporate data. Option A is a full wipe; Option B is not automatic; Option D is for conditional access, not data removal.

Answer

Create a compliance policy that marks the device as non-compliant after 30 days of inactivity.

Answer

Configure a device wipe action in Intune that can be triggered manually from the console.

Answer

Enable conditional access to require the device to be compliant before accessing data.