SC-100 Recommend security best practices and priorities — All Questions With Answers

Question 1

A company is designing a defense-in-depth strategy for their Azure environment. They want to ensure that if a virtual machine is compromised, the attacker cannot move laterally to other VMs in the same virtual network. Which security control should they prioritize?

Accepted Answer

Implement network segmentation using NSGs and application security groups. Network segmentation using NSGs and application security groups is the correct priority because it directly controls east-west traffic between VMs within the same virtual network. By defining explicit inbound and outbound rules that restrict communication to only necessary ports and protocols (e.g., TCP 443 for HTTPS), an attacker who compromises one VM cannot initiate lateral movement to other VMs, as the NSG will drop unauthorized traffic at the subnet or NIC level.

Answer

Enable Azure DDoS Protection on the virtual network

Answer

Enable multi-factor authentication (MFA) for all admin accounts

Answer

Deploy Azure Bastion for secure remote access

Question 2

A company uses Azure Policy to enforce compliance. They have a custom policy that denies creation of storage accounts without encryption enabled. A developer reports that they cannot create a storage account even though they specified encryption. What is the most likely cause?

Accepted Answer

The policy's 'then' block uses 'deny' but the condition logic evaluates the 'encryption' property incorrectly. Option C is correct because the most likely cause is that the policy's condition logic incorrectly evaluates the 'encryption' property. Azure Policy uses JSON-based condition expressions to check resource properties; if the condition does not match the actual property path (e.g., 'properties.encryption.enabled' vs. 'properties.encryption') or uses an incorrect operator, the deny effect will trigger even when encryption is specified. This is a common misconfiguration in custom policies.

Answer

The developer does not have 'Microsoft.Authorization/policyAssignments/write' permission

Answer

The policy effect is set to 'audit' instead of 'deny'

Answer

The policy is scoped to a management group that includes the developer's subscription

Question 3

A company is moving to a zero-trust security model. Which principle is most important for securing network traffic?

Accepted Answer

Verify explicitly every access request. In a zero-trust model, the principle of 'verify explicitly' means every access request—regardless of source—must be authenticated, authorized, and encrypted before being allowed. This eliminates implicit trust based on network location, which is the core shift from traditional perimeter-based security.

Answer

Rely on perimeter firewalls to block threats

Answer

Trust all traffic within the corporate network

Answer

Allow all traffic and monitor for anomalies

Question 4

A company uses Azure Security Center and Azure Sentinel. They want to prioritize remediation of vulnerabilities based on risk. Which metric should they use to rank vulnerabilities?

Accepted Answer

Azure Secure Score impact. Azure Secure Score impact is the correct metric because it directly reflects the risk-based prioritization of security recommendations within Azure Security Center. Each recommendation has a Secure Score impact value that indicates how much your overall security posture improves when remediated, allowing you to prioritize actions that reduce the most risk. This aligns with the scenario's goal of ranking vulnerabilities by risk, as Secure Score impact is calculated using factors like exploitability, threat intelligence, and potential business impact.

Answer

Common Vulnerability Scoring System (CVSS) score

Answer

Compliance status from Azure Policy

Answer

Number of security alerts triggered

Question 5

A company is implementing a cloud security governance strategy. They need to ensure that all Azure resources are compliant with internal security policies before deployment. Which approach should they use?

Accepted Answer

Assign Azure Policy definitions with 'deny' effect at the subscription scope. Azure Policy with the 'deny' effect is the correct approach because it proactively prevents the deployment of any resource that violates defined security policies at the subscription scope. This ensures compliance before deployment by evaluating the resource against policy rules during the creation or update operation, blocking the request if non-compliant. Unlike reactive measures, this enforces governance at the point of deployment without requiring post-deployment remediation.

Answer

Configure Azure Firewall to block non-compliant resources

Answer

Deploy resources using Azure Blueprints

Answer

Use Azure DevOps pipelines with manual approval gates

Question 6

A company wants to protect sensitive data in their Azure SQL Database from unauthorized access. Which feature should they enable?

Accepted Answer

Transparent Data Encryption (TDE). Transparent Data Encryption (TDE) performs real-time I/O encryption and decryption of the data and log files at the page level, protecting data at rest in Azure SQL Database. This directly addresses the requirement to prevent unauthorized access to the underlying storage files, as TDE ensures that data cannot be read if the physical media is compromised.

Answer

Azure Information Protection

Answer

Azure Key Vault

Answer

Azure Firewall

Question 7

A company is using Azure Active Directory (Azure AD) for identity management. They want to implement a policy that requires all users to use multi-factor authentication (MFA) when accessing Office 365 from outside the corporate network. Which conditional access policy setting should they configure?

Accepted Answer

Assignments > Conditions > Locations. Option B is correct because the Locations condition in Azure AD Conditional Access allows administrators to define named locations (such as corporate IP ranges) and then require MFA when access originates from any location that is not trusted. By configuring a policy that targets 'All users' and 'All cloud apps' (or specifically Office 365), and setting the Locations condition to 'Any location' with the exclusion of the corporate network, the policy enforces MFA for all external access attempts. This directly meets the requirement to require MFA when accessing Office 365 from outside the corporate network.

Answer

Assignments > Conditions > Client apps

Answer

Assignments > Conditions > Device platforms

Answer

Assignments > Conditions > Sign-in risk

Question 8

A company is planning a migration to Azure and wants to ensure that their security operations center (SOC) has visibility into all Azure resources. They need to collect security logs from multiple subscriptions into a central workspace. Which Azure service should they use?

Accepted Answer

Azure Sentinel. Azure Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) solution designed to ingest security logs from multiple Azure subscriptions, on-premises sources, and third-party clouds into a single central workspace. It provides the SOC with unified visibility, threat detection, and incident response across all Azure resources, meeting the requirement for centralized security log collection.

Answer

Azure Security Center

Answer

Azure Policy

Answer

Azure Monitor

Question 9

Which TWO of the following are best practices for securing Azure Kubernetes Service (AKS)?

Accepted Answer

Use Azure AD integration for authentication. Azure AD integration for AKS enables role-based access control (RBAC) using Azure AD identities, allowing fine-grained permissions for cluster operations. This eliminates the need for shared static credentials and supports conditional access policies, multi-factor authentication, and audit logging via Azure AD sign-in logs. It is a foundational security best practice for identity management in Kubernetes clusters.

Answer

Deploy all applications in the default namespace

Answer

Use service principals instead of managed identities for pod identity

Answer

Enable SSH access to all worker nodes for troubleshooting

Question 10

Which THREE of the following are key components of a defense-in-depth strategy?

Accepted Answer

Physical security. Physical security is a foundational layer in defense-in-depth, protecting hardware assets from unauthorized physical access, theft, or tampering. It includes measures like biometric locks, surveillance cameras, and secure server rooms, which prevent attackers from bypassing logical controls by directly interacting with systems.

Answer

Flat network topology

Answer

Single sign-on (SSO)

Question 11

Which TWO of the following are true about Azure Policy initiatives?

Accepted Answer

Initiatives can be assigned to management groups, subscriptions, or resource groups. Azure Policy initiatives (also known as policy sets) are designed to group multiple policy definitions together to achieve a common compliance goal. They can be assigned at the management group, subscription, or resource group scope, which allows for broad or granular enforcement of compliance rules across the Azure hierarchy.

Answer

Initiatives cannot be assigned to a management group

Answer

An initiative can only contain one policy definition

Answer

Initiatives are predefined and cannot be customized

Question 12

Refer to the exhibit. A company creates this Azure Policy definition and assigns it to a subscription. A developer attempts to create a storage account with blob encryption enabled. The creation fails. What is the most likely reason?

Accepted Answer

The field path for blob encryption is case-sensitive and may not match the actual property. The policy definition uses the field path `Microsoft.Storage/storageAccounts/encryption.services.blob.enabled` to check for blob encryption. Azure Resource Manager property paths are case-sensitive, and the actual property for blob encryption is `Microsoft.Storage/storageAccounts/encryption.services.blob.enabled` with lowercase 'b' in 'blob'. If the path in the policy uses incorrect casing (e.g., 'Blob' with capital B), the policy engine cannot match the property, causing the deny effect to trigger incorrectly or fail to evaluate properly, leading to creation failure.

Answer

The policy effect is set to 'deny' but should be 'audit'

Answer

The policy uses 'allOf' incorrectly; it should use 'anyOf'

Answer

The field path is not a valid Azure Resource Manager path

Question 13

Refer to the exhibit. The ContosoPlatform management group has an Azure Policy assignment that denies all deployments without encryption. The App1 subscription contains a storage account that was created without encryption. Why is the storage account still non-compliant?

Accepted Answer

The storage account is in App1 subscription, which is under ContosoApplication, not ContosoPlatform. Option A is correct because Azure Policy inheritance only applies to direct child management groups and subscriptions. The App1 subscription is a direct child of the ContosoApplication management group, not ContosoPlatform. Since the policy denying deployments without encryption is assigned at ContosoPlatform, it does not inherit to App1 because App1 is not a direct descendant of ContosoPlatform. The storage account was created without encryption and is not subject to the policy, so it remains non-compliant.

Answer

The policy is assigned at ContosoPlatform, but App1 is not a direct child

Answer

The policy is assigned at ContosoRoot, but ContosoPlatform overrides it

Answer

Azure Policy does not inherit from parent management groups

Question 14

You are the lead security architect for a multinational corporation that recently completed a merger. The new entity, Contoso Ltd., has a complex Azure environment with over 200 subscriptions spread across multiple management groups. The company's security team has identified several critical issues: (1) many subscriptions have Azure Security Center's Secure Score below 30%, (2) there are numerous unmanaged VMs with public IP addresses, (3) there is no centralized logging for security events, and (4) identity management is fragmented with multiple Azure AD tenants. The CEO mandates a 'zero-trust' security posture within 12 months. You have a limited budget and must prioritize the most impactful actions. Which course of action should you take first?

Accepted Answer

Consolidate all Azure AD tenants into a single tenant and establish a common identity baseline. Option C is correct because identity is the foundational control plane for zero-trust architecture. Without a unified identity baseline across a single Azure AD tenant, you cannot enforce consistent conditional access policies, least-privilege access, or authentication strength—making all other security controls ineffective. Consolidating tenants first directly addresses the fragmented identity management issue and enables centralized policy enforcement, which is the highest-impact, lowest-cost action to improve the security posture within 12 months.

Answer

Implement Azure Sentinel to centralize logs and create automated response playbooks

Answer

Deploy Azure Firewall and enforce forced tunneling for all VNets

Answer

Deploy Azure Policy to deny creation of VMs with public IPs and enforce NSGs

Question 15

A company is deploying Microsoft Defender for Cloud to protect a multi-cloud environment that includes Azure and AWS. The security team wants to prioritize the highest-risk recommendations. Which feature should they use to identify and focus on the most critical security issues?

Accepted Answer

Use Secure Score and its recommendations. Secure Score in Microsoft Defender for Cloud aggregates all security recommendations and assigns a score based on their relative risk and impact. By focusing on recommendations that most improve the Secure Score, the security team can systematically prioritize the highest-risk issues across both Azure and AWS resources. This directly aligns with the goal of identifying and focusing on the most critical security issues.

Answer

Regulatory Compliance dashboard

Answer

Enable Defender for Cloud's enhanced security features

Answer

Review attack path analysis

Question 16

A financial services organization is designing a zero-trust architecture for its Azure environment. They need to ensure that all administrative access to critical systems uses just-in-time (JIT) access and that privileged role assignments are time-bound. Which combination of Microsoft security best practices should they implement?

Accepted Answer

Azure AD Privileged Identity Management (PIM) and Azure Bastion. Azure AD Privileged Identity Management (PIM) provides just-in-time (JIT) activation and time-bound role assignments for privileged roles, directly meeting the requirement for time-bound administrative access. Azure Bastion enables secure, audited RDP/SSH access to Azure VMs without exposing public IP addresses, ensuring that administrative sessions are isolated and monitored. Together, they enforce zero-trust principles by granting ephemeral, scoped access to critical systems.

Answer

Azure AD Conditional Access and Azure AD Identity Protection

Answer

Azure Policy and Azure Blueprints

Answer

Azure Sentinel and Azure Workbook

Question 17

A company uses Azure DevOps for CI/CD. The security team wants to ensure that secrets like API keys and connection strings are never stored in code repositories. Which best practice should they recommend?

Accepted Answer

Use Azure Key Vault references in Azure DevOps variable groups. Option B is correct because Azure Key Vault references in Azure DevOps variable groups allow secrets to be securely linked to pipelines without ever storing them in code repositories. At pipeline runtime, the agent retrieves the secret value directly from Azure Key Vault using a managed identity or service principal, ensuring secrets are never exposed in YAML files, logs, or build artifacts.

Answer

Use environment variables in the pipeline YAML

Answer

Encrypt secrets using Git-secret and commit to repo

Answer

Store secrets in Azure App Configuration with encryption

Question 18

A large enterprise is implementing Microsoft Defender for Cloud to improve their security posture. Which TWO actions should they take to prioritize and remediate security recommendations effectively? (Choose two.)

Accepted Answer

Enable automatic remediation for high-priority recommendations. Option B is correct because Microsoft Defender for Cloud allows you to enable automatic remediation for high-priority recommendations, which automatically applies the necessary configuration changes (e.g., enabling encryption or installing endpoint protection) when a recommendation is triggered. This reduces manual effort and ensures critical security gaps are closed quickly. Option C is correct because the Secure Score aggregates all recommendations into a numerical score, and focusing on recommendations that provide the highest score improvement directly correlates to the most significant risk reduction, aligning with Microsoft's guidance for prioritization.

Answer

Assign each recommendation to a specific team member manually

Answer

Ignore recommendations with low severity to save time

Answer

Disable recommendations that generate security alerts

Question 19

Refer to the exhibit. A security architect reviews the Azure AD Conditional Access policy JSON. The policy is intended to require MFA for all users accessing Azure management (Microsoft Azure Management app ID 797f4846-ba77-4853-9e6f-4433c3e1d1c5), except for the BreakGlassAdmin account and from trusted locations. However, some users report being prompted for MFA even when connecting from the corporate office (which is marked as a trusted location). What is the most likely cause?

Accepted Answer

The corporate office location is not correctly defined as a trusted location in Azure AD. Option A is correct because the policy is designed to require MFA for all users accessing Azure management, except for the BreakGlassAdmin account and from trusted locations. If the corporate office location is not correctly defined as a trusted location in Azure AD, the Conditional Access policy will not recognize it as an exception, and users connecting from that location will still be prompted for MFA. This mismatch between the intended trusted location definition and the actual location configuration is the most likely cause of the unexpected MFA prompts.

Answer

The grant controls operator is set to 'OR' instead of 'AND'

Answer

The policy is in 'Report-only' mode

Answer

The policy applies to all cloud apps, not just Azure management

Question 20

You are the security architect for a multinational corporation that uses Azure Active Directory (Azure AD) and Microsoft 365. The company has recently experienced a security incident where a compromised user account was used to access sensitive data from a legacy application that does not support modern authentication. To mitigate this risk, you have been asked to recommend a set of security best practices and priorities. The environment includes 50,000 users, 200 applications (many legacy), and a hybrid identity setup with Active Directory Domain Services (AD DS) synchronized to Azure AD via Azure AD Connect. The security team wants to reduce the attack surface, enforce least privilege, and improve identity protection. Current issues include: (1) many users have standing admin privileges on workstations, (2) legacy apps use shared service accounts with weak passwords, (3) Conditional Access policies are not applied consistently, and (4) there is no process for reviewing privileged role assignments. Which course of action should you recommend as the highest priority?

Accepted Answer

Implement Azure AD Privileged Identity Management (PIM) for just-in-time access and role approval workflows. Option B is correct because implementing Azure AD Privileged Identity Management (PIM) directly addresses the highest-priority risk: the lack of oversight and control over privileged role assignments. With 50,000 users and many standing admin privileges on workstations, PIM enables just-in-time (JIT) activation, approval workflows, and time-bound roles, which drastically reduces the attack surface by eliminating permanent privileged access. This is the most critical first step because unmanaged privileged accounts are the primary vector for lateral movement and data exfiltration, as demonstrated in the incident.

Answer

Migrate legacy applications to support modern authentication and use Azure AD Application Proxy

Answer

Deploy Azure AD Password Protection and enforce banned password lists

Answer

Implement Conditional Access policies to block legacy authentication and require MFA for all users

SC-100 Recommend security best practices and priorities — All Questions With Answers

A company is designing a defense-in-depth strategy for their Azure environment. They want to ensure that if a virtual machine is compromised, the attacker cannot move laterally to other VMs in the same virtual network. Which security control should they prioritize?

A company uses Azure Policy to enforce compliance. They have a custom policy that denies creation of storage accounts without encryption enabled. A developer reports that they cannot create a storage account even though they specified encryption. What is the most likely cause?

A company is moving to a zero-trust security model. Which principle is most important for securing network traffic?

A company uses Azure Security Center and Azure Sentinel. They want to prioritize remediation of vulnerabilities based on risk. Which metric should they use to rank vulnerabilities?

A company is implementing a cloud security governance strategy. They need to ensure that all Azure resources are compliant with internal security policies before deployment. Which approach should they use?

A company wants to protect sensitive data in their Azure SQL Database from unauthorized access. Which feature should they enable?

A company is using Azure Active Directory (Azure AD) for identity management. They want to implement a policy that requires all users to use multi-factor authentication (MFA) when accessing Office 365 from outside the corporate network. Which conditional access policy setting should they configure?

A company is planning a migration to Azure and wants to ensure that their security operations center (SOC) has visibility into all Azure resources. They need to collect security logs from multiple subscriptions into a central workspace. Which Azure service should they use?

Which TWO of the following are best practices for securing Azure Kubernetes Service (AKS)?

Which THREE of the following are key components of a defense-in-depth strategy?

Which TWO of the following are true about Azure Policy initiatives?

Refer to the exhibit. A company creates this Azure Policy definition and assigns it to a subscription. A developer attempts to create a storage account with blob encryption enabled. The creation fails. What is the most likely reason?

Exhibit

Refer to the exhibit. The ContosoPlatform management group has an Azure Policy assignment that denies all deployments without encryption. The App1 subscription contains a storage account that was created without encryption. Why is the storage account still non-compliant?

Exhibit

A company is deploying Microsoft Defender for Cloud to protect a multi-cloud environment that includes Azure and AWS. The security team wants to prioritize the highest-risk recommendations. Which feature should they use to identify and focus on the most critical security issues?

A company uses Azure DevOps for CI/CD. The security team wants to ensure that secrets like API keys and connection strings are never stored in code repositories. Which best practice should they recommend?

A large enterprise is implementing Microsoft Defender for Cloud to improve their security posture. Which TWO actions should they take to prioritize and remediate security recommendations effectively? (Choose two.)

Exhibit

Order the steps to configure Azure DDoS Protection Standard for a virtual network.

Order the steps to configure Azure Policy to enforce tagging on resources.

Match each compliance framework to its focus area.

Match each Azure policy effect to its behavior.

SC-100 Recommend security best practices and priorities — All Questions With Answers

A company is designing a defense-in-depth strategy for their Azure environment. They want to ensure that if a virtual machine is compromised, the attacker cannot move laterally to other VMs in the same virtual network. Which security control should they prioritize?

A company uses Azure Policy to enforce compliance. They have a custom policy that denies creation of storage accounts without encryption enabled. A developer reports that they cannot create a storage account even though they specified encryption. What is the most likely cause?

A company is moving to a zero-trust security model. Which principle is most important for securing network traffic?

A company uses Azure Security Center and Azure Sentinel. They want to prioritize remediation of vulnerabilities based on risk. Which metric should they use to rank vulnerabilities?

A company is implementing a cloud security governance strategy. They need to ensure that all Azure resources are compliant with internal security policies before deployment. Which approach should they use?

A company wants to protect sensitive data in their Azure SQL Database from unauthorized access. Which feature should they enable?

A company is using Azure Active Directory (Azure AD) for identity management. They want to implement a policy that requires all users to use multi-factor authentication (MFA) when accessing Office 365 from outside the corporate network. Which conditional access policy setting should they configure?

A company is planning a migration to Azure and wants to ensure that their security operations center (SOC) has visibility into all Azure resources. They need to collect security logs from multiple subscriptions into a central workspace. Which Azure service should they use?

Which TWO of the following are best practices for securing Azure Kubernetes Service (AKS)?

Which THREE of the following are key components of a defense-in-depth strategy?

Which TWO of the following are true about Azure Policy initiatives?

Refer to the exhibit. A company creates this Azure Policy definition and assigns it to a subscription. A developer attempts to create a storage account with blob encryption enabled. The creation fails. What is the most likely reason?

Exhibit

Refer to the exhibit. The ContosoPlatform management group has an Azure Policy assignment that denies all deployments without encryption. The App1 subscription contains a storage account that was created without encryption. Why is the storage account still non-compliant?

Exhibit

A company is deploying Microsoft Defender for Cloud to protect a multi-cloud environment that includes Azure and AWS. The security team wants to prioritize the highest-risk recommendations. Which feature should they use to identify and focus on the most critical security issues?

A company uses Azure DevOps for CI/CD. The security team wants to ensure that secrets like API keys and connection strings are never stored in code repositories. Which best practice should they recommend?

A large enterprise is implementing Microsoft Defender for Cloud to improve their security posture. Which TWO actions should they take to prioritize and remediate security recommendations effectively? (Choose two.)

Exhibit

Order the steps to configure Azure DDoS Protection Standard for a virtual network.

Order the steps to configure Azure Policy to enforce tagging on resources.

Match each compliance framework to its focus area.

Match each Azure policy effect to its behavior.