SC-100 Design security for infrastructure Practice Test 1 — 15 Questions

Question 1

A company is designing a hybrid network architecture using Azure ExpressRoute. They need to ensure that all traffic between on-premises and Azure is encrypted and authenticated. Which configuration should they implement?

Accepted Answer

Use ExpressRoute with MACsec. Option C is correct because MACsec (IEEE 802.1AE) provides Layer 2 encryption and authentication for traffic traversing ExpressRoute Direct ports, ensuring that all data between on-premises and Azure is encrypted at the physical link level. This meets the requirement for both encryption and authentication without relying on higher-layer protocols like IPsec, which would add overhead and complexity.

Answer

Use VPN Gateway over ExpressRoute

Answer

Use ExpressRoute Direct with BGP

Answer

Use Azure Firewall to inspect ExpressRoute traffic

Question 2

An organization uses Microsoft Defender for Cloud to secure their multi-cloud environment, including Azure and AWS. They want to ensure that all AWS EC2 instances are automatically onboarded to Defender for Cloud. What should they configure?

Accepted Answer

Set up the AWS connector in Defender for Cloud. Option C is correct because the AWS connector in Microsoft Defender for Cloud is the native integration that enables automatic discovery and onboarding of AWS resources, including EC2 instances, into Defender for Cloud. Once configured, the connector uses AWS IAM roles and APIs to continuously sync EC2 inventory and apply Defender plans (e.g., Defender for Servers) without requiring manual agent installation on each instance.

Answer

Deploy Azure Arc on each EC2 instance

Answer

Use AWS Systems Manager to push Defender workload

Answer

Configure AWS Config rules to report to Defender

Question 3

A company plans to deploy Azure Virtual Desktop (AVD) in a secure environment. They require that all user connections be established over a reverse connect protocol to avoid inbound firewall rules. Which component enables this?

Accepted Answer

AVD Gateway service. The AVD Gateway service is the correct component because it establishes a reverse connect transport, where the session host initiates an outbound connection to the gateway over HTTPS (port 443). This eliminates the need for any inbound firewall rules to the session hosts, as user connections are relayed through the gateway without directly exposing the session hosts to the internet.

Answer

Azure Bastion

Answer

Azure AD Application Proxy

Answer

Session host configuration

Question 4

A financial services company is deploying a three-tier application on Azure. They need to ensure that the web tier can only communicate with the application tier, and the application tier can only communicate with the data tier. All tiers should use private IP addresses. What is the most secure way to implement this?

Accepted Answer

Deploy Azure Firewall and use application rules. Azure Firewall with application rules (FQDN-based) provides the most secure and granular control for east-west traffic between tiers. It can inspect and filter traffic at Layer 7 (application layer) using TLS inspection, ensuring only allowed application protocols (e.g., HTTPS) and specific FQDNs are permitted, while blocking all other traffic. This meets the requirement for private IP communication and enforces a zero-trust model between tiers.

Answer

Use Network Security Groups (NSGs) on each subnet

Answer

Use VNet peering with route tables

Answer

Use Azure Web Application Firewall (WAF)

Question 5

A company uses Azure Kubernetes Service (AKS) with Azure Active Directory (Azure AD) integration. They want to restrict developers to only be able to create and manage pods and services, but not modify cluster-level resources like nodes or namespaces. What should they configure?

Accepted Answer

Create a custom ClusterRole with rules for pods and services, then bind it to the developer group with a ClusterRoleBinding. Option B is correct because Kubernetes RBAC allows fine-grained authorization. A custom ClusterRole can define rules for pods and services (core API group resources), and a ClusterRoleBinding binds it to the developer group across all namespaces. This grants the required permissions without allowing modifications to cluster-level resources like nodes or namespaces, which are not included in the custom role's rules.

Answer

Assign the cluster-admin ClusterRole to the developers

Answer

Create a RoleBinding in each namespace for developers

Answer

Use Azure RBAC to grant Contributor role on the AKS cluster

Question 6

A company has a hybrid identity deployment using Azure AD Connect. They want to ensure that if a user's on-premises account is disabled, the corresponding Azure AD account is also disabled within 30 minutes. Which setting should they configure?

Accepted Answer

Configure the synchronization interval for directory changes. Option B is correct because Azure AD Connect's default synchronization cycle for directory changes is 30 minutes. By configuring the synchronization interval (via the Azure AD Connect scheduler or PowerShell), you can ensure that disabled on-premises accounts are reflected in Azure AD within that timeframe. This setting directly controls how frequently Azure AD Connect processes and synchronizes changes from the on-premises Active Directory to Azure AD.

Answer

Enable password hash synchronization

Answer

Install Azure AD Application Proxy

Answer

Enable password writeback

Question 7

A company is deploying Azure SQL Database with Azure Active Directory authentication for their application. They want to ensure that only specific Azure AD users can access the database, and that these users are authenticated at the database level. What should they do?

Accepted Answer

Create contained database users mapped to Azure AD identities. Option D is correct because contained database users in Azure SQL Database are authenticated directly at the database level using Azure AD identities, without requiring a server-level login. This allows you to grant access to specific Azure AD users or groups while enforcing authentication within the database itself, aligning with the requirement for database-level authentication.

Answer

Create a server-level login for each user

Answer

Assign the Azure AD admin to the SQL server

Answer

Configure firewall rules to allow specific IPs

Question 8

A company uses Azure Policy to enforce compliance. They want to automatically remediate non-compliant resources by deploying a custom template. Which effect should they use in the policy definition?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is correct because it allows Azure Policy to automatically remediate non-compliant resources by deploying a custom ARM template when the resource is found to be non-compliant. This effect is specifically designed for automatic remediation scenarios, as it triggers a deployment to bring the resource into compliance without manual intervention.

Answer

Audit

Answer

Disabled

Answer

Deny

Question 9

Which TWO of the following are true about Azure DDoS Protection?

Accepted Answer

It can be used to protect against application-layer attacks when combined with WAF. Option C is correct because Azure DDoS Protection operates at Layers 3 and 4 of the OSI model, but when combined with Azure Application Gateway WAF (Web Application Firewall), it can also mitigate application-layer (Layer 7) attacks such as SQL injection or cross-site scripting. The WAF inspects HTTP/HTTPS traffic and blocks malicious payloads, while Azure DDoS Protection handles volumetric attacks, providing a layered defense.

Answer

It automatically blocks all traffic during an attack

Answer

It protects VMs from internal traffic attacks

Answer

It provides a monthly allowance of attacks

Question 10

Which THREE of the following are best practices for securing Azure Kubernetes Service (AKS)?

Accepted Answer

Enable Azure Policy for AKS. A is correct because Azure Policy for AKS enforces organizational standards and assesses compliance at scale by applying built-in policies that restrict privileged containers, require pod security standards, and enforce HTTPS ingress. This reduces the attack surface and ensures clusters adhere to security baselines without manual intervention.

Answer

Store secrets in Kubernetes secrets

Answer

Allow all node pools to communicate freely

Question 11

Which TWO of the following are valid methods to secure traffic between on-premises and Azure?

Accepted Answer

ExpressRoute with MACsec. ExpressRoute with MACsec provides encryption at Layer 2 using the IEEE 802.1AE standard, securing traffic between on-premises and Azure over a private connection without traversing the public internet. Site-to-Site VPN uses IPsec (IKEv1/IKEv2) to encrypt traffic over the public internet, establishing a secure tunnel between the on-premises VPN device and Azure VPN Gateway. Both are valid methods for securing traffic, with ExpressRoute+MACsec offering lower latency and higher throughput for private connectivity.

Answer

Azure Front Door

Answer

Azure Traffic Manager

Answer

Azure CDN

Question 12

Refer to the exhibit. An Azure policy is defined as shown. Which resources will be audited?

Accepted Answer

Virtual machines with Standard_LRS managed disks. The Azure policy definition in the exhibit uses the 'auditIfNotExists' effect with a condition that checks if the 'Microsoft.Compute/virtualMachines' resource type has a 'Microsoft.Compute/disks' resource of type 'Standard_LRS' associated. This means the policy audits virtual machines that do NOT have a managed disk of type Standard_LRS, effectively auditing VMs with unmanaged disks or other managed disk SKUs. Option C is correct because the policy specifically targets virtual machines with Standard_LRS managed disks for audit, as the condition evaluates to true when the disk type is Standard_LRS, triggering the audit effect.

Answer

All Azure resources that are not compliant

Answer

All virtual machines with unmanaged disks

Answer

Virtual machines with Premium_LRS managed disks and disk size 1024 GB

Question 13

Refer to the exhibit. A network policy is applied in the production namespace. What is the effect on the webapp pod's ability to reach external services?

Accepted Answer

All egress traffic except to kube-dns is denied. Option D is correct because the network policy in the exhibit defines an egress rule that only allows traffic to kube-dns (port 53, UDP) and denies all other egress traffic by default. Since no other egress rules are specified, the webapp pod cannot reach any external services except the cluster's DNS resolver.

Answer

Ingress traffic is blocked

Answer

The pod can only communicate with kube-dns

Answer

The pod can communicate with any service

Question 14

You are a cybersecurity architect for a multinational corporation that is migrating its on-premises workloads to Azure. The environment includes 500 virtual machines across multiple subscriptions, managed through Azure Policy and Azure Blueprints. The security team has reported that some VMs are not receiving the latest security updates despite being configured for automatic updates via the Azure Update Management solution. Additionally, you have noticed that some VMs are missing the Azure Monitor agent, which is required for security monitoring. The company uses Azure Security Center (now Defender for Cloud) with the standard tier enabled. You need to ensure that all VMs are compliant with the company's security baseline, which requires: (1) all VMs must have the Azure Monitor agent installed, (2) all VMs must be enrolled in the Update Management solution, and (3) all VMs must be protected by Microsoft Defender for Cloud. What should you do to enforce compliance and remediate non-compliant VMs?

Accepted Answer

Use Azure Policy with built-in initiatives such as 'Enable Azure Monitor for VMs' and 'Configure machines to automatically install updates' and assign them to all subscriptions. Option A is correct because Azure Policy with built-in initiatives like 'Enable Azure Monitor for VMs' and 'Configure machines to automatically install updates' provides a declarative, scalable, and continuous compliance enforcement mechanism. These initiatives automatically remediate non-compliant VMs by deploying the required agents and configurations across all subscriptions, ensuring all three security baseline requirements are met without manual intervention.

Answer

Create a new Azure Blueprint that includes the required configurations and assign it to all subscriptions

Answer

Use Azure Automation to run scripts that install the agent and enable updates on all VMs

Answer

Configure Microsoft Defender for Cloud to automatically install the Azure Monitor agent and enable updates

Question 15

You are a security architect for a healthcare organization that is deploying a new application on Azure. The application consists of a web frontend (Azure App Service), an API layer (Azure Functions), and a database (Azure SQL Database). The organization requires that all data be encrypted at rest and in transit. Additionally, they need to ensure that only authenticated and authorized users can access the API, and that the database is accessible only from the API layer. The organization also wants to use managed identities to avoid storing credentials. You have deployed the resources. Now you need to configure the security settings. What should you do to meet the requirements?

Accepted Answer

Enable HTTPS-only on App Service, enable Azure SQL Database transparent data encryption, configure Azure AD authentication for SQL, and set the SQL firewall to allow Azure services. Option B is correct because it meets all requirements: HTTPS-only ensures encryption in transit for the web frontend; Azure SQL Database TDE provides encryption at rest by default; configuring Azure AD authentication for SQL eliminates stored credentials and supports managed identities; and setting the SQL firewall to 'Allow Azure services' restricts database access to Azure resources, including the API layer, without exposing a public IP.

Answer

Enable App Service Authentication with Azure AD, configure the API to use API keys, and enable Always Encrypted on SQL

Answer

Enable HTTPS-only on App Service, enable Azure SQL Database firewall to allow the API's public IP, and use SQL authentication

Answer

Use Azure Front Door with WAF, store connection strings in Azure Key Vault, and enable Azure SQL Database auditing