SC-100 Design security solutions for infrastructure — 15 Questions

Question 1

Your organization uses Microsoft Sentinel to monitor hybrid workloads. You need to design a solution to detect lateral movement attempts from compromised on-premises servers to Azure VMs. Which data connector should you prioritize?

Accepted Answer

Windows Security Events via AMA. Option B is correct because the Windows Security Events via AMA connector provides the necessary event IDs (e.g., 4624, 4625) for lateral movement detection on Azure VMs. Option A is wrong because Azure Activity Log does not capture OS-level events. Option C is wrong because Syslog via AMA covers Linux but not Windows. Option D is wrong because Office 365 connector is for cloud app activity.

Answer

Syslog via AMA

Answer

Office 365 Logs

Answer

Azure Activity Log

Question 2

A company plans to use Microsoft Defender for Cloud to secure a multi-cloud environment including Azure, AWS, and GCP. What is the first step to enable multi-cloud visibility?

Accepted Answer

Connect AWS and GCP accounts using the cloud connectors in Defender for Cloud. Option C is correct because you must first onboard the AWS/GCP accounts into Defender for Cloud by connecting them via the native cloud connectors. Option A is wrong because deploying Azure Arc agents is for on-premises servers, not cloud accounts. Option B is wrong because enabling Defender plans is done after onboarding. Option D is wrong because custom policies are optional.

Answer

Enable all Defender plans for subscription

Answer

Create custom compliance policies

Answer

Deploy Azure Arc agents on all cloud VMs

Question 3

You are designing a secure DevOps pipeline using GitHub Advanced Security and Microsoft Defender for Cloud. The development team uses a mix of Python and JavaScript. Which tool should you integrate to detect secrets (e.g., API keys) committed to the repository?

Accepted Answer

GitHub secret scanning. Option A is correct because GitHub secret scanning automatically detects secrets in repositories. Option B is wrong because Dependabot focuses on dependency vulnerabilities. Option C is wrong because CodeQL analyzes code for security vulnerabilities, not secrets. Option D is wrong because Defender for Cloud’s DevOps security posture management does not replace secret scanning.

Answer

CodeQL code scanning

Answer

Dependabot alerts

Answer

Defender for Cloud DevOps security posture management

Question 4

Which TWO Azure policies should you assign to enforce secure configuration of Azure SQL Database? (Select two.)

Accepted Answer

Ensure that 'Auditing' is set to 'On' for SQL Database. Option A is correct because enabling Auditing on Azure SQL Database captures all database events and writes them to an audit log in your Azure storage account, Log Analytics workspace, or Event Hubs. This is a fundamental security control for compliance and forensic analysis, as it provides a record of who did what and when, which is essential for detecting and investigating unauthorized access or changes.

Answer

Ensure that 'TDE' is enabled for SQL Server VMs

Answer

Audit SQL Server level audit setting

Answer

Ensure secure transfer to storage accounts is enabled

Question 5

Which THREE features of Microsoft Defender for Cloud help secure Azure Kubernetes Service (AKS) clusters? (Select three.)

Accepted Answer

Azure Defender for Kubernetes (cluster hardening). Azure Defender for Kubernetes (now part of Microsoft Defender for Cloud's cloud workload protection) provides cluster hardening recommendations by assessing AKS cluster configurations against industry benchmarks like CIS. It identifies misconfigurations such as overly permissive RBAC roles, insecure network policies, or unencrypted secrets, and offers remediation steps to reduce the attack surface.

Answer

Advanced threat protection for Azure Cosmos DB

Answer

DDoS Protection Standard

Question 6

Which TWO actions should you take to improve the security posture of an Azure subscription using Microsoft Defender for Cloud? (Select two.)

Accepted Answer

Enable Azure Defender plans for all supported resource types. Options A and B are correct because enabling Defender plans and implementing recommendations improve security. Option C is wrong because Defender for Cloud already provides recommendations. Option D is wrong because vulnerability assessment for VMs is a feature, not a specific action. Option E is wrong because assigning Azure Policy is a method, but the most direct actions are enabling plans and implementing recommendations.

Answer

Assign Azure Policy to enforce resource compliance

Answer

Create custom security policies

Answer

Deploy vulnerability assessment solution to all VMs

Question 7

Refer to the exhibit. You are reviewing an Azure Policy definition. What does this policy accomplish?

Accepted Answer

Denies creation of network security rules that allow traffic to ports other than 22 and 3389. Option C is correct because the policy denies security rules that allow ports other than 22 (SSH) and 3389 (RDP) as destination ports. Option A is wrong because it allows only specific ports. Option B is wrong because it allows those ports. Option D is wrong because it doesn't enforce a specific range.

Answer

Requires that all network security rules have destination port range between 22 and 3389

Answer

Denies all inbound traffic except SSH and RDP

Answer

Allows only SSH and RDP inbound traffic

Question 8

Refer to the exhibit. You need to ensure that the storage account 'seccorpstorage' is only accessible from a specific Azure virtual network. What should you do?

Accepted Answer

Add a virtual network rule for the specific VNet. Option B is correct because you need to add a virtual network rule to allow traffic from the VNet. The current configuration has no rules, so all traffic is denied. Option A is wrong because the storage account already has public network access disabled. Option C is wrong because enabling firewall and adding IP rules would allow specific IPs, not a VNet. Option D is wrong because adding a service endpoint alone is incomplete without the rule.

Answer

Enable the service endpoint for Microsoft.Storage on the VNet subnet

Answer

Enable firewall and add an IP rule for the VNet's public IP

Answer

Enable public network access and add a firewall rule

Question 9

Refer to the exhibit. You are deploying an ARM template for a network security group. What is the security implication of this configuration?

Accepted Answer

The rule allows inbound HTTPS traffic from any Internet source to the subnet, which may be overly permissive. Option C is correct because the rule allows HTTPS from the Internet to the subnet 10.0.1.0/24, making the frontend accessible from anywhere, which is a security risk if not intended. Option A is wrong because the rule does allow Internet traffic. Option B is wrong because the rule is inbound, not outbound. Option D is wrong because the rule allows traffic on port 443.

Answer

The rule only allows traffic on port 443 from a specific IP range

Answer

The rule allows outbound traffic from the subnet to the Internet

Answer

The rule blocks all inbound traffic from the Internet

Question 10

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only approved applications can run on corporate devices. Which Intune feature should you configure?

Accepted Answer

AppLocker. Option B is correct because AppLocker allows you to create policies to control which apps can run. Option A is wrong because Windows Defender Firewall controls network traffic. Option C is wrong because BitLocker encrypts drives. Option D is wrong because Windows Information Protection prevents data leaks.

Answer

Windows Defender Firewall

Answer

BitLocker

Answer

Windows Information Protection

Question 11

You need to design a solution to protect Azure VMs from malware and vulnerabilities. Which Microsoft service should you use?

Accepted Answer

Microsoft Defender for Cloud. Option C is correct because Microsoft Defender for Cloud provides threat detection, vulnerability assessment, and antimalware for VMs. Option A is wrong because Microsoft Sentinel is a SIEM. Option B is wrong because Microsoft Intune is for device management. Option D is wrong because Microsoft Purview is for data governance.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 12

Your company uses Azure Firewall to filter outbound traffic from a virtual network. You need to allow only HTTP and HTTPS traffic to specific FQDNs, while blocking all other outbound traffic. Which Azure Firewall rule type should you use?

Accepted Answer

Application rule. Option D is correct because application rules allow filtering based on FQDNs for HTTP/HTTPS. Option A is wrong because network rules filter by IP/port, not FQDN. Option B is wrong because NAT rules only translate addresses. Option C is wrong because threat intelligence rules block known malicious IPs.

Answer

NAT rule

Answer

Threat intelligence rule

Answer

Network rule

Question 13

You are designing a secure hybrid network connectivity solution between an on-premises datacenter and Azure. The requirement is to have encrypted traffic and high availability. Which service should you use?

Accepted Answer

Azure VPN Gateway. Option C is correct because VPN Gateway provides encrypted site-to-site VPN with active-active configuration for high availability. Option A is wrong because ExpressRoute offers private connectivity but encryption is optional. Option B is wrong because Azure Bastion is for RDP/SSH access. Option D is wrong because Azure Front Door is a global load balancer.

Answer

Azure Front Door

Answer

Azure ExpressRoute

Answer

Azure Bastion

Question 14

You need to ensure that Azure SQL Database always encrypts data at rest and in transit. Which features should you enable?

Accepted Answer

Transparent Data Encryption (TDE) and enforce TLS connections. Option B is correct because Transparent Data Encryption (TDE) encrypts data at rest, and enforcing TLS encrypts data in transit. Option A is wrong because Always Encrypted encrypts specific columns, not the entire database. Option C is wrong because Azure Defender for SQL provides threat detection. Option D is wrong because firewall rules control access.

Answer

Firewall rules and Azure Active Directory authentication

Answer

Always Encrypted and firewall rules

Answer

Azure Defender for SQL and vulnerability assessment

Question 15

Your organization uses Microsoft Sentinel for security operations. You need to design a solution to automatically respond to a confirmed compromise of a domain controller by isolating the affected VM. Which automation feature should you use?

Accepted Answer

Automation rules with a playbook. Option A is correct because automation rules can trigger a playbook that runs a script to isolate the VM. Option B is wrong because analytics rules generate alerts but do not respond. Option C is wrong because workbooks visualize data. Option D is wrong because hunting queries are for proactive searches.

Answer

Analytics rules with incident creation

Answer

Hunting queries

Answer

Workbooks