SC-100 Recommend security best practices and priorities — 15 Questions

Question 1

A company is designing a defense-in-depth strategy for their Azure environment. They want to ensure that if a virtual machine is compromised, the attacker cannot move laterally to other VMs in the same virtual network. Which security control should they prioritize?

Accepted Answer

Implement network segmentation using NSGs and application security groups. Network segmentation using NSGs and application security groups is the correct priority because it directly controls east-west traffic between VMs within the same virtual network. By defining explicit inbound and outbound rules that restrict communication to only necessary ports and protocols (e.g., TCP 443 for HTTPS), an attacker who compromises one VM cannot initiate lateral movement to other VMs, as the NSG will drop unauthorized traffic at the subnet or NIC level.

Answer

Enable Azure DDoS Protection on the virtual network

Answer

Enable multi-factor authentication (MFA) for all admin accounts

Answer

Deploy Azure Bastion for secure remote access

Question 2

A company uses Azure Policy to enforce compliance. They have a custom policy that denies creation of storage accounts without encryption enabled. A developer reports that they cannot create a storage account even though they specified encryption. What is the most likely cause?

Accepted Answer

The policy's 'then' block uses 'deny' but the condition logic evaluates the 'encryption' property incorrectly. Option C is correct because the most likely cause is that the policy's condition logic incorrectly evaluates the 'encryption' property. Azure Policy uses JSON-based condition expressions to check resource properties; if the condition does not match the actual property path (e.g., 'properties.encryption.enabled' vs. 'properties.encryption') or uses an incorrect operator, the deny effect will trigger even when encryption is specified. This is a common misconfiguration in custom policies.

Answer

The developer does not have 'Microsoft.Authorization/policyAssignments/write' permission

Answer

The policy effect is set to 'audit' instead of 'deny'

Answer

The policy is scoped to a management group that includes the developer's subscription

Question 3

A company is moving to a zero-trust security model. Which principle is most important for securing network traffic?

Accepted Answer

Verify explicitly every access request. In a zero-trust model, the principle of 'verify explicitly' means every access request—regardless of source—must be authenticated, authorized, and encrypted before being allowed. This eliminates implicit trust based on network location, which is the core shift from traditional perimeter-based security.

Answer

Rely on perimeter firewalls to block threats

Answer

Trust all traffic within the corporate network

Answer

Allow all traffic and monitor for anomalies

Question 4

A company uses Azure Security Center and Azure Sentinel. They want to prioritize remediation of vulnerabilities based on risk. Which metric should they use to rank vulnerabilities?

Accepted Answer

Azure Secure Score impact. Azure Secure Score impact is the correct metric because it directly reflects the risk-based prioritization of security recommendations within Azure Security Center. Each recommendation has a Secure Score impact value that indicates how much your overall security posture improves when remediated, allowing you to prioritize actions that reduce the most risk. This aligns with the scenario's goal of ranking vulnerabilities by risk, as Secure Score impact is calculated using factors like exploitability, threat intelligence, and potential business impact.

Answer

Common Vulnerability Scoring System (CVSS) score

Answer

Compliance status from Azure Policy

Answer

Number of security alerts triggered

Question 5

A company is implementing a cloud security governance strategy. They need to ensure that all Azure resources are compliant with internal security policies before deployment. Which approach should they use?

Accepted Answer

Assign Azure Policy definitions with 'deny' effect at the subscription scope. Azure Policy with the 'deny' effect is the correct approach because it proactively prevents the deployment of any resource that violates defined security policies at the subscription scope. This ensures compliance before deployment by evaluating the resource against policy rules during the creation or update operation, blocking the request if non-compliant. Unlike reactive measures, this enforces governance at the point of deployment without requiring post-deployment remediation.

Answer

Configure Azure Firewall to block non-compliant resources

Answer

Deploy resources using Azure Blueprints

Answer

Use Azure DevOps pipelines with manual approval gates

Question 6

A company wants to protect sensitive data in their Azure SQL Database from unauthorized access. Which feature should they enable?

Accepted Answer

Transparent Data Encryption (TDE). Transparent Data Encryption (TDE) performs real-time I/O encryption and decryption of the data and log files at the page level, protecting data at rest in Azure SQL Database. This directly addresses the requirement to prevent unauthorized access to the underlying storage files, as TDE ensures that data cannot be read if the physical media is compromised.

Answer

Azure Information Protection

Answer

Azure Key Vault

Answer

Azure Firewall

Question 7

A company is using Azure Active Directory (Azure AD) for identity management. They want to implement a policy that requires all users to use multi-factor authentication (MFA) when accessing Office 365 from outside the corporate network. Which conditional access policy setting should they configure?

Accepted Answer

Assignments > Conditions > Locations. Option B is correct because the Locations condition in Azure AD Conditional Access allows administrators to define named locations (such as corporate IP ranges) and then require MFA when access originates from any location that is not trusted. By configuring a policy that targets 'All users' and 'All cloud apps' (or specifically Office 365), and setting the Locations condition to 'Any location' with the exclusion of the corporate network, the policy enforces MFA for all external access attempts. This directly meets the requirement to require MFA when accessing Office 365 from outside the corporate network.

Answer

Assignments > Conditions > Client apps

Answer

Assignments > Conditions > Device platforms

Answer

Assignments > Conditions > Sign-in risk

Question 8

A company is planning a migration to Azure and wants to ensure that their security operations center (SOC) has visibility into all Azure resources. They need to collect security logs from multiple subscriptions into a central workspace. Which Azure service should they use?

Accepted Answer

Azure Sentinel. Azure Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) solution designed to ingest security logs from multiple Azure subscriptions, on-premises sources, and third-party clouds into a single central workspace. It provides the SOC with unified visibility, threat detection, and incident response across all Azure resources, meeting the requirement for centralized security log collection.

Answer

Azure Security Center

Answer

Azure Policy

Answer

Azure Monitor

Question 9

Which TWO of the following are best practices for securing Azure Kubernetes Service (AKS)?

Accepted Answer

Use Azure AD integration for authentication. Azure AD integration for AKS enables role-based access control (RBAC) using Azure AD identities, allowing fine-grained permissions for cluster operations. This eliminates the need for shared static credentials and supports conditional access policies, multi-factor authentication, and audit logging via Azure AD sign-in logs. It is a foundational security best practice for identity management in Kubernetes clusters.

Answer

Deploy all applications in the default namespace

Answer

Use service principals instead of managed identities for pod identity

Answer

Enable SSH access to all worker nodes for troubleshooting

Question 10

Which THREE of the following are key components of a defense-in-depth strategy?

Accepted Answer

Physical security. Physical security is a foundational layer in defense-in-depth, protecting hardware assets from unauthorized physical access, theft, or tampering. It includes measures like biometric locks, surveillance cameras, and secure server rooms, which prevent attackers from bypassing logical controls by directly interacting with systems.

Answer

Flat network topology

Answer

Single sign-on (SSO)

Question 11

Which TWO of the following are true about Azure Policy initiatives?

Accepted Answer

Initiatives can be assigned to management groups, subscriptions, or resource groups. Azure Policy initiatives (also known as policy sets) are designed to group multiple policy definitions together to achieve a common compliance goal. They can be assigned at the management group, subscription, or resource group scope, which allows for broad or granular enforcement of compliance rules across the Azure hierarchy.

Answer

Initiatives cannot be assigned to a management group

Answer

An initiative can only contain one policy definition

Answer

Initiatives are predefined and cannot be customized

Question 12

Refer to the exhibit. A company creates this Azure Policy definition and assigns it to a subscription. A developer attempts to create a storage account with blob encryption enabled. The creation fails. What is the most likely reason?

Accepted Answer

The field path for blob encryption is case-sensitive and may not match the actual property. The policy definition uses the field path `Microsoft.Storage/storageAccounts/encryption.services.blob.enabled` to check for blob encryption. Azure Resource Manager property paths are case-sensitive, and the actual property for blob encryption is `Microsoft.Storage/storageAccounts/encryption.services.blob.enabled` with lowercase 'b' in 'blob'. If the path in the policy uses incorrect casing (e.g., 'Blob' with capital B), the policy engine cannot match the property, causing the deny effect to trigger incorrectly or fail to evaluate properly, leading to creation failure.

Answer

The policy effect is set to 'deny' but should be 'audit'

Answer

The policy uses 'allOf' incorrectly; it should use 'anyOf'

Answer

The field path is not a valid Azure Resource Manager path

Question 13

Refer to the exhibit. The ContosoPlatform management group has an Azure Policy assignment that denies all deployments without encryption. The App1 subscription contains a storage account that was created without encryption. Why is the storage account still non-compliant?

Accepted Answer

The storage account is in App1 subscription, which is under ContosoApplication, not ContosoPlatform. Option A is correct because Azure Policy inheritance only applies to direct child management groups and subscriptions. The App1 subscription is a direct child of the ContosoApplication management group, not ContosoPlatform. Since the policy denying deployments without encryption is assigned at ContosoPlatform, it does not inherit to App1 because App1 is not a direct descendant of ContosoPlatform. The storage account was created without encryption and is not subject to the policy, so it remains non-compliant.

Answer

The policy is assigned at ContosoPlatform, but App1 is not a direct child

Answer

The policy is assigned at ContosoRoot, but ContosoPlatform overrides it

Answer

Azure Policy does not inherit from parent management groups

Question 14

You are the lead security architect for a multinational corporation that recently completed a merger. The new entity, Contoso Ltd., has a complex Azure environment with over 200 subscriptions spread across multiple management groups. The company's security team has identified several critical issues: (1) many subscriptions have Azure Security Center's Secure Score below 30%, (2) there are numerous unmanaged VMs with public IP addresses, (3) there is no centralized logging for security events, and (4) identity management is fragmented with multiple Azure AD tenants. The CEO mandates a 'zero-trust' security posture within 12 months. You have a limited budget and must prioritize the most impactful actions. Which course of action should you take first?

Accepted Answer

Consolidate all Azure AD tenants into a single tenant and establish a common identity baseline. Option C is correct because identity is the foundational control plane for zero-trust architecture. Without a unified identity baseline across a single Azure AD tenant, you cannot enforce consistent conditional access policies, least-privilege access, or authentication strength—making all other security controls ineffective. Consolidating tenants first directly addresses the fragmented identity management issue and enables centralized policy enforcement, which is the highest-impact, lowest-cost action to improve the security posture within 12 months.

Answer

Implement Azure Sentinel to centralize logs and create automated response playbooks

Answer

Deploy Azure Firewall and enforce forced tunneling for all VNets

Answer

Deploy Azure Policy to deny creation of VMs with public IPs and enforce NSGs

Question 15

A company is deploying Microsoft Defender for Cloud to protect a multi-cloud environment that includes Azure and AWS. The security team wants to prioritize the highest-risk recommendations. Which feature should they use to identify and focus on the most critical security issues?

Accepted Answer

Use Secure Score and its recommendations. Secure Score in Microsoft Defender for Cloud aggregates all security recommendations and assigns a score based on their relative risk and impact. By focusing on recommendations that most improve the Secure Score, the security team can systematically prioritize the highest-risk issues across both Azure and AWS resources. This directly aligns with the goal of identifying and focusing on the most critical security issues.

Answer

Regulatory Compliance dashboard

Answer

Enable Defender for Cloud's enhanced security features

Answer

Review attack path analysis