SC-100 Design security solutions for infrastructure — 20 Questions

Question 1

You are designing a secure DevOps pipeline using GitHub Advanced Security and Microsoft Defender for Cloud. The development team uses a mix of Python and JavaScript. Which tool should you integrate to detect secrets (e.g., API keys) committed to the repository?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GitHub secret scanning. GitHub secret scanning automatically detects secrets in repositories. Option B is wrong because CodeQL analyzes code for security vulnerabilities, not secrets. Option C is wrong because Dependabot focuses on dependency vulnerabilities. Option D is wrong because Defender for Cloud’s DevOps security posture management does not replace secret scanning.

Answer

CodeQL code scanning

Answer

Dependabot alerts

Answer

Defender for Cloud DevOps security posture management

Question 2

Refer to the exhibit. You are deploying an ARM template for a network security group. What is the security implication of this configuration?

Accepted Answer

The rule allows inbound HTTPS traffic from any Internet source to the subnet, which may be overly permissive. The rule allows HTTPS from the Internet to the subnet 10.0.1.0/24, making the frontend accessible from anywhere, which is a security risk if not intended. Option A is wrong because the rule does allow Internet traffic. Option B is wrong because the rule is inbound, not outbound. Option D is wrong because the rule allows traffic on port 443.

Answer

The rule only allows traffic on port 443 from a specific IP range

Answer

The rule allows outbound traffic from the subnet to the Internet

Answer

The rule blocks all inbound traffic from the Internet

Question 3

You need to design a solution to protect Azure VMs from malware and vulnerabilities. Which Microsoft service should you use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud is the correct answer because it provides unified security management, threat detection, vulnerability assessment, and antimalware capabilities for Azure VMs. Microsoft Sentinel is a SIEM (Security Information and Event Management) solution, not a VM-specific protection service. Microsoft Intune is for device and application management, and Microsoft Purview is for data governance and compliance.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 4

Your organization uses Microsoft Sentinel for security operations. You need to design a solution to automatically respond to a confirmed compromise of a domain controller by isolating the affected VM. Which automation feature should you use?

Accepted Answer

Automation rules with a playbook. Automation rules can trigger a playbook that runs a script to isolate the VM. Option B is wrong because analytics rules generate alerts but do not respond. Option C is wrong because workbooks visualize data. Option D is wrong because hunting queries are for proactive searches.

Answer

Analytics rules with incident creation

Answer

Hunting queries

Answer

Workbooks

Question 5

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to design a solution that automatically creates an incident in Sentinel when a Defender XDR alert fires. Which integration should you configure?

Accepted Answer

Microsoft Defender XDR data connector in Sentinel. The Microsoft Defender XDR data connector in Sentinel allows alert streaming and automatic incident creation. Option A is wrong because Azure Logic Apps can automate responses but is not the primary integration for automatic incident creation; the data connector is the standard method. Option B is wrong because Microsoft Power Automate can be used but is not the primary integration; the data connector is the designed method. Option D is wrong because Microsoft Graph API provides programmatic access but is not the configured integration for automatic incident creation.

Answer

Azure Logic Apps with Defender XDR connector

Answer

Microsoft Power Automate flow triggered by Defender XDR alerts

Answer

Microsoft Graph API subscription to Defender XDR alerts

Question 6

Your organization uses Microsoft Purview to classify data assets. You need to design a solution that automatically scans data sources in Azure SQL Database for sensitive information. Which Purview scanner should you configure?

Accepted Answer

Purview scanning rule set for Azure SQL Database. The correct option is B, the Purview scanning rule set for Azure SQL Database, because in Microsoft Purview a scan is defined by combining a data source registration with a scan rule set that specifies which classification rules (such as sensitive information types) are applied to Azure SQL Database assets. This rule set is what drives the automated detection of sensitive data during a scan, so configuring it is the required step for automatic classification. Option A is not a distinct Purview scanner component; Azure SQL Database is registered as a data source and scanned using a rule set rather than a standalone 'Azure SQL Scanner.' Option C, Purview Insights, is a reporting/analytics capability that surfaces scan results and does not perform scanning itself. Option D, Microsoft Defender for SQL, is a security threat-detection and vulnerability-assessment service, not a Purview classification scanner.

Answer

Azure SQL Scanner (Purview)

Answer

Purview Insights

Answer

Microsoft Defender for SQL

Question 7

Which TWO actions should you take to secure an Azure Kubernetes Service (AKS) cluster using Microsoft Defender for Cloud?

Accepted Answer

Apply built-in Azure Policy initiatives for AKS. Options A and D are correct because enabling Microsoft Defender for Containers provides threat detection and vulnerability scanning for AKS clusters, and applying built-in Azure Policy initiatives ensures compliance with security best practices. Option B is incorrect because enabling private cluster mode is a network configuration, not a Microsoft Defender for Cloud action. Option C is incorrect because configuring NSGs on subnets is a general networking practice and not specific to Defender for Cloud. Option E is incorrect because deploying Azure Firewall is a network security tool, but it is not part of the Defender for Cloud security controls for AKS.

Answer

Enable private cluster mode

Answer

Configure Network Security Groups (NSGs) on AKS subnets

Answer

Deploy Azure Firewall in the AKS virtual network

Question 8

Which THREE components are required to implement a Zero Trust network architecture using Microsoft Entra Internet Access (formerly Microsoft 365 Network Connectivity)?

Accepted Answer

Conditional Access policies. Option A (Conditional Access policies) is correct because Entra Internet Access relies on Conditional Access to evaluate signals such as user identity, device state, and risk before granting access to internet and SaaS resources, enforcing the "never trust, always verify" principle. Option D (Microsoft Intune device compliance policies) is correct because device compliance status is a key signal consumed by Conditional Access; Intune marks devices as compliant or non-compliant, which Zero Trust uses to gate access. Option E (Microsoft Entra Internet Access / Microsoft Global Secure Access) is correct because it is the actual service that provides the Zero Trust network architecture, routing traffic through the Security Service Edge (SSE) client and applying identity-aware, policy-based controls to internet and Microsoft 365 traffic. Option B (Microsoft Entra application proxy) is not required because it is a separate feature for publishing and remotely accessing on-premises web applications, not a core component of Entra Internet Access Zero Trust networking. Option C (Site-to-site VPN) is not required because Zero Trust with Entra Internet Access uses the Global Secure Access client and SSE-based traffic forwarding rather than traditional network-level VPN tunnels.

Answer

Azure AD Application Proxy

Answer

Site-to-site VPN

Question 9

Your organization is deploying Azure Kubernetes Service (AKS) and plans to use Azure Policy to enforce security controls on the cluster. The security team wants to automatically audit and deny the creation of privileged containers. Which Azure Policy initiative should you assign?

Accepted Answer

Azure Policy for Kubernetes (preview). The correct option is B, Azure Policy for Kubernetes (preview), because it is the initiative that extends Azure Policy's audit and deny enforcement to Kubernetes resources inside an AKS cluster, including pod security rules such as denying privileged containers. It works via the Gatekeeper/OPA admission controller so non-compliant pod creation is blocked at admission time. Option A, Azure RBAC roles for AKS, governs control-plane authorization for users and service principals, not pod-level security policies. Option C, Microsoft Defender for Containers, provides threat detection and posture assessment rather than policy-based deny enforcement. Option D, AKS Pod Identity, is used to let pods obtain Microsoft Entra ID tokens for accessing Azure resources, not to enforce container security controls.

Answer

Azure RBAC roles for AKS

Answer

Microsoft Defender for Containers

Answer

AKS Pod Identity

Question 10

You are designing a security solution for a critical Azure SQL Database that must be protected against data exfiltration by a compromised admin account. The solution must ensure that even a database administrator cannot copy data to an external storage account. Which Azure service should you configure?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention (option C) is correct because it can detect and block sensitive data being exfiltrated from Azure SQL Database to external destinations such as storage accounts, even when the actor is a privileged administrator, by enforcing DLP policies at the data layer. This addresses the insider-threat scenario where a compromised admin tries to copy data out, since DLP policies apply regardless of the user's database permissions. Always Encrypted (A) only protects data at rest and in transit by encrypting columns, but it does not prevent an authorized admin from reading plaintext and copying it elsewhere. Azure SQL Database firewall rules (B) only restrict network access by IP range and do not stop an already-connected admin from exporting data. Azure Information Protection (D) is for classifying and labeling documents and emails, not for enforcing exfiltration controls on Azure SQL Database.

Answer

Always Encrypted

Answer

Azure SQL Database firewall rules

Answer

Azure Information Protection

Question 11

Your organization is planning to use Microsoft Sentinel for security information and event management (SIEM). The security team wants to ensure that Sentinel can ingest logs from on-premises servers that are not connected to the internet. The solution must use Azure Arc for management. Which data connector should you use?

Accepted Answer

Azure Monitor Agent. The Azure Monitor Agent (AMA) can be deployed via Azure Arc to on-premises servers, collecting logs and forwarding them to Sentinel via a Log Analytics workspace. Option B (Common Event Format via AMA) is wrong because the Common Event Format (CEF) connector requires a forwarder with internet access. Option C is wrong because the Syslog connector typically requires direct connectivity or a forwarder. Option D (Log Analytics agent) is wrong because the Log Analytics agent (MMA) is being deprecated.

Answer

Common Event Format (CEF) via AMA

Answer

Syslog via AMA

Answer

Log Analytics agent (MMA)

Question 12

Which THREE components are required to implement a Microsoft Sentinel solution that collects security logs from a multi-cloud environment including AWS and Azure? (Choose three.)

Accepted Answer

Log Analytics workspace. Option A (Log Analytics workspace) is correct because Microsoft Sentinel stores all ingested security data and runs its analytics, hunting, and workbook queries on top of a Log Analytics workspace, so one is mandatory for any Sentinel deployment. Option C (Azure Monitor Agent, AMA) is correct because AMA is the supported agent for collecting logs from Azure and non-Azure (including AWS) machines via Data Collection Rules, replacing the legacy Log Analytics agent. Option D (AWS S3 data connector) is correct because the Sentinel AWS S3 connector uses the AWS S3 data connector to pull CloudTrail and other AWS service logs from an S3 bucket into Sentinel for multi-cloud visibility. Option B (Microsoft Sentinel solution) is not required to collect logs; it is a packaged content offering (workbooks, analytics rules) that is optional and does not itself perform data ingestion. Option E (Azure Arc) is not required because Arc-enabled servers are only needed to onboard non-Azure machines for AMA-based collection, but the question asks for the components required for the multi-cloud log collection solution, and the AWS S3 connector handles AWS logs without Arc.

Answer

Microsoft Sentinel solution

Answer

Azure Arc

Question 13

Which TWO of the following are valid methods to enforce multifactor authentication (MFA) for users accessing Microsoft 365 services? (Choose two.)

Accepted Answer

Per-user MFA in the Microsoft 365 admin center. Conditional Access policies (E) are a valid method because they let administrators create access policies that require MFA for users when they access Microsoft 365 cloud apps, based on conditions such as user, group, location, device, or app. Per-user MFA in the Microsoft 365 admin center (D) is also valid because it allows administrators to enable MFA for individual user accounts, forcing those users to register and use a second authentication factor when signing in. PIM (A) is not a general MFA enforcement method; it manages just-in-time privileged role activation and approval workflows. Security defaults (B) provide baseline security settings including MFA enforcement, but they are not a method to enforce MFA for users accessing Microsoft 365 services in the same direct, configurable way as the two correct options. Identity Protection policies (C) focus on detecting and responding to risky sign-ins and users, not on directly enforcing MFA for all Microsoft 365 access.

Answer

Privileged Identity Management (PIM)

Answer

Security defaults

Answer

Identity Protection policies

Question 14

A company is planning to deploy a multi-tier application in Azure. The web tier must be accessible from the internet, while the database tier must be accessible only from the web tier and management jump boxes. The solution should minimize exposure to the internet. Which Azure architecture should you recommend?

Accepted Answer

Deploy Azure Firewall in a hub virtual network and peer spoke virtual networks for each tier, routing traffic through the firewall.. Azure Firewall in a hub virtual network with forced tunneling through a firewall provides centralized control and minimizes exposure. NSGs cannot inspect traffic, and Application Gateway alone does not restrict database access. VNet peering without firewall does not enforce inspection.

Answer

Use Azure Bastion for management and VNet peering between web and database subnets.

Answer

Place web and database tiers in the same virtual network and use Network Security Groups (NSGs) to restrict access.

Answer

Use Azure Application Gateway to expose the web tier and place the database tier in a separate subnet with a deny-all NSG.

Question 15

Your company uses Microsoft Sentinel as its SIEM. You need to design a solution to detect lateral movement attempts within the corporate network using Windows Event Logs collected from domain controllers and workstations. Which data source and analytic rule type should you use?

Accepted Answer

Windows Security Events with a Fusion rule. Windows Security Events from domain controllers and workstations, with a Fusion or multi-event analytic rule, can detect lateral movement patterns like pass-the-hash. Sysmon is useful but not the only source. Scheduled query rules are for single events. Anomaly rules use machine learning but may not be as precise.

Answer

Azure Activity logs with an anomaly rule

Answer

Windows Security Events with a scheduled query rule

Answer

Sysmon logs with a scheduled query rule

Question 16

You need to secure Azure Kubernetes Service (AKS) clusters by ensuring that only approved container images from a private Azure Container Registry (ACR) can be deployed. The solution should enforce this at admission time. Which Azure Policy effect should you use?

Accepted Answer

enforceRegoPolicy. The 'enforceRegoPolicy' effect for Azure Policy on AKS uses Open Policy Agent (OPA) Gatekeeper to enforce that only images from specific registries are allowed. 'audit' only logs, 'deny' is not directly applicable for AKS admission, 'modify' changes resources but does not block.

Answer

modify

Answer

audit

Answer

deny

Question 17

You are designing a secure access strategy for Azure SQL Database. The solution must use Microsoft Entra authentication and ensure that only specific client IP addresses can connect. Additionally, all connections must be encrypted in transit. Which THREE components should you configure?

Accepted Answer

Microsoft Entra authentication for the SQL server. Microsoft Entra authentication is required for identity-based access. A server-level firewall rule allows specific IPs. Enforcing TLS 1.2 ensures encryption in transit. Private endpoint is not required for IP-based filtering. Microsoft Entra ID admin is a user, not a component. Always Encrypted is for column-level encryption, not network security.

Answer

Enable Always Encrypted for sensitive columns

Answer

Configure an Azure Private Endpoint for the SQL server

Question 18

Your company uses Microsoft Defender for Endpoint and Microsoft Intune to manage endpoints. You need to ensure that devices are healthy before they can access corporate resources. Which TWO settings should you configure in Microsoft Intune compliance policies to enforce device health?

Accepted Answer

Require device encryption (BitLocker) on Windows devices. Requiring antivirus (Windows Defender) to be active ensures protection against malware. Requiring encryption (BitLocker) protects data at rest on lost devices. Password length and OS version are important but not the most direct health checks for threat protection. Jailbreak detection is for mobile devices.

Answer

Require a minimum password length of 8 characters

Answer

Require that the device is not jailbroken or rooted

Answer

Require the device to be on a specific OS version

Question 19

Refer to the exhibit. You are reviewing a PowerShell script that configures network security. What is the effect of the NSG rule created in this script?

Accepted Answer

It blocks all inbound traffic from the internet to the subnet.. The rule denies all inbound traffic from the 'Internet' service tag to all ports and protocols. 'Internet' includes traffic from outside Azure. The rule is applied at the subnet level. It does not affect outbound traffic, nor traffic from other Azure services unless they originate from the internet.

Answer

It blocks all outbound traffic to the internet from the subnet.

Answer

It blocks inbound traffic only from specific IP ranges.

Answer

It allows inbound traffic from the internet, then denies it.

Question 20

Refer to the exhibit. You are reviewing an ARM template for an Azure App Service configuration. What is the effect of the ipSecurityRestrictions array?

Accepted Answer

It allows traffic from 192.168.0.0/24 and denies all other traffic.. The rules are evaluated in priority order. The first rule allows traffic from 192.168.0.0/24. The second rule denies all other traffic (Any). This effectively restricts access to only the specified corporate IP range. The order matters because if the deny rule had lower priority, it would block the allowed range.

Answer

It allows all traffic because the deny rule has a higher priority number.

Answer

It denies traffic from 192.168.0.0/24 and allows all other traffic.

Answer

It denies all traffic because the deny rule covers any IP.