SC-100 Design security for infrastructure — 10 Questions

Question 1

A company is designing a hybrid network architecture using Azure ExpressRoute. They need to ensure that all traffic between on-premises and Azure is encrypted and authenticated. Which configuration should they implement?

Accepted Answer

Use ExpressRoute with MACsec. Option C is correct because MACsec (IEEE 802.1AE) provides Layer 2 encryption and authentication for traffic traversing ExpressRoute Direct ports, ensuring that all data between on-premises and Azure is encrypted at the physical link level. This meets the requirement for both encryption and authentication without relying on higher-layer protocols like IPsec, which would add overhead and complexity.

Answer

Use VPN Gateway over ExpressRoute

Answer

Use ExpressRoute Direct with BGP

Answer

Use Azure Firewall to inspect ExpressRoute traffic

Question 2

An organization uses Microsoft Defender for Cloud to secure their multi-cloud environment, including Azure and AWS. They want to ensure that all AWS EC2 instances are automatically onboarded to Defender for Cloud. What should they configure?

Accepted Answer

Set up the AWS connector in Defender for Cloud. Option C is correct because the AWS connector in Microsoft Defender for Cloud is the native integration that enables automatic discovery and onboarding of AWS resources, including EC2 instances, into Defender for Cloud. Once configured, the connector uses AWS IAM roles and APIs to continuously sync EC2 inventory and apply Defender plans (e.g., Defender for Servers) without requiring manual agent installation on each instance.

Answer

Deploy Azure Arc on each EC2 instance

Answer

Use AWS Systems Manager to push Defender workload

Answer

Configure AWS Config rules to report to Defender

Question 3

A company plans to deploy Azure Virtual Desktop (AVD) in a secure environment. They require that all user connections be established over a reverse connect protocol to avoid inbound firewall rules. Which component enables this?

Accepted Answer

AVD Gateway service. The AVD Gateway service is the correct component because it establishes a reverse connect transport, where the session host initiates an outbound connection to the gateway over HTTPS (port 443). This eliminates the need for any inbound firewall rules to the session hosts, as user connections are relayed through the gateway without directly exposing the session hosts to the internet.

Answer

Azure Bastion

Answer

Azure AD Application Proxy

Answer

Session host configuration

Question 4

A financial services company is deploying a three-tier application on Azure. They need to ensure that the web tier can only communicate with the application tier, and the application tier can only communicate with the data tier. All tiers should use private IP addresses. What is the most secure way to implement this?

Accepted Answer

Deploy Azure Firewall and use application rules. Azure Firewall with application rules (FQDN-based) provides the most secure and granular control for east-west traffic between tiers. It can inspect and filter traffic at Layer 7 (application layer) using TLS inspection, ensuring only allowed application protocols (e.g., HTTPS) and specific FQDNs are permitted, while blocking all other traffic. This meets the requirement for private IP communication and enforces a zero-trust model between tiers.

Answer

Use Network Security Groups (NSGs) on each subnet

Answer

Use VNet peering with route tables

Answer

Use Azure Web Application Firewall (WAF)

Question 5

A company uses Azure Kubernetes Service (AKS) with Azure Active Directory (Azure AD) integration. They want to restrict developers to only be able to create and manage pods and services, but not modify cluster-level resources like nodes or namespaces. What should they configure?

Accepted Answer

Create a custom ClusterRole with rules for pods and services, then bind it to the developer group with a ClusterRoleBinding. Option B is correct because Kubernetes RBAC allows fine-grained authorization. A custom ClusterRole can define rules for pods and services (core API group resources), and a ClusterRoleBinding binds it to the developer group across all namespaces. This grants the required permissions without allowing modifications to cluster-level resources like nodes or namespaces, which are not included in the custom role's rules.

Answer

Assign the cluster-admin ClusterRole to the developers

Answer

Create a RoleBinding in each namespace for developers

Answer

Use Azure RBAC to grant Contributor role on the AKS cluster

Question 6

A company has a hybrid identity deployment using Azure AD Connect. They want to ensure that if a user's on-premises account is disabled, the corresponding Azure AD account is also disabled within 30 minutes. Which setting should they configure?

Accepted Answer

Configure the synchronization interval for directory changes. Option B is correct because Azure AD Connect's default synchronization cycle for directory changes is 30 minutes. By configuring the synchronization interval (via the Azure AD Connect scheduler or PowerShell), you can ensure that disabled on-premises accounts are reflected in Azure AD within that timeframe. This setting directly controls how frequently Azure AD Connect processes and synchronizes changes from the on-premises Active Directory to Azure AD.

Answer

Enable password hash synchronization

Answer

Install Azure AD Application Proxy

Answer

Enable password writeback

Question 7

A company is deploying Azure SQL Database with Azure Active Directory authentication for their application. They want to ensure that only specific Azure AD users can access the database, and that these users are authenticated at the database level. What should they do?

Accepted Answer

Create contained database users mapped to Azure AD identities. Option D is correct because contained database users in Azure SQL Database are authenticated directly at the database level using Azure AD identities, without requiring a server-level login. This allows you to grant access to specific Azure AD users or groups while enforcing authentication within the database itself, aligning with the requirement for database-level authentication.

Answer

Create a server-level login for each user

Answer

Assign the Azure AD admin to the SQL server

Answer

Configure firewall rules to allow specific IPs

Question 8

A company uses Azure Policy to enforce compliance. They want to automatically remediate non-compliant resources by deploying a custom template. Which effect should they use in the policy definition?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is correct because it allows Azure Policy to automatically remediate non-compliant resources by deploying a custom ARM template when the resource is found to be non-compliant. This effect is specifically designed for automatic remediation scenarios, as it triggers a deployment to bring the resource into compliance without manual intervention.

Answer

Audit

Answer

Disabled

Answer

Deny

Question 9

Which TWO of the following are true about Azure DDoS Protection?

Accepted Answer

It can be used to protect against application-layer attacks when combined with WAF. Option C is correct because Azure DDoS Protection operates at Layers 3 and 4 of the OSI model, but when combined with Azure Application Gateway WAF (Web Application Firewall), it can also mitigate application-layer (Layer 7) attacks such as SQL injection or cross-site scripting. The WAF inspects HTTP/HTTPS traffic and blocks malicious payloads, while Azure DDoS Protection handles volumetric attacks, providing a layered defense.

Answer

It automatically blocks all traffic during an attack

Answer

It protects VMs from internal traffic attacks

Answer

It provides a monthly allowance of attacks

Question 10

Which THREE of the following are best practices for securing Azure Kubernetes Service (AKS)?

Accepted Answer

Enable Azure Policy for AKS. A is correct because Azure Policy for AKS enforces organizational standards and assesses compliance at scale by applying built-in policies that restrict privileged containers, require pod security standards, and enforce HTTPS ingress. This reduces the attack surface and ensures clusters adhere to security baselines without manual intervention.

Answer

Store secrets in Kubernetes secrets

Answer

Allow all node pools to communicate freely