SC-100 Design security solutions for infrastructure Practice Test 10 — 15 Questions

Question 1

You are designing a security solution for an Azure SQL Database that stores sensitive customer data. The solution must encrypt the database at rest and in transit, and also mask sensitive columns from non-privileged users. Which combination of features should you implement?

Accepted Answer

Transparent Data Encryption (TDE) and Dynamic Data Masking (DDM). Option B is correct because Transparent Data Encryption (TDE) encrypts the database at rest, and Dynamic Data Masking (DDM) masks sensitive columns. Option A is wrong because Always Encrypted encrypts columns at the client side, but does not encrypt the database at rest. Option C is wrong because Always Encrypted does not encrypt at rest fully, and TDE plus DDM is the correct combination. Option D is wrong because cell-level encryption is complex and not native to Azure SQL.

Answer

Always Encrypted and Row-Level Security

Answer

Always Encrypted and Dynamic Data Masking (DDM)

Answer

Cell-level encryption and row-level security

Question 2

Your company plans to migrate on-premises servers to Azure. You need to ensure that the migrated servers are protected against malware and vulnerabilities. Which Microsoft Defender for Cloud plan should you enable for the Azure VMs?

Accepted Answer

Microsoft Defender for Servers. Option A is correct because Microsoft Defender for Servers provides malware protection, vulnerability assessment, and threat detection for Azure VMs. Option B is wrong because Defender for Containers is for container workloads. Option C is wrong because Defender for Storage is for storage accounts. Option D is wrong because Defender for SQL is for SQL databases.

Answer

Microsoft Defender for SQL

Answer

Microsoft Defender for Storage

Answer

Microsoft Defender for Containers

Question 3

You are designing a secure access solution for on-premises applications using Microsoft Entra ID. The solution must support modern authentication, single sign-on (SSO), and Conditional Access. Which TWO technologies should you implement?

Accepted Answer

Microsoft Entra application proxy. Option A and C are correct. Microsoft Entra application proxy publishes on-premises apps with modern authentication and SSO. Microsoft Entra application gallery provides pre-integrated SSO for SaaS apps, but for on-premises apps, the proxy is used. Option B is wrong because VPN does not provide modern authentication or Conditional Access. Option D is wrong because Microsoft Entra Domain Services is for domain join, not app access. Option E is wrong because Azure AD B2C is for customer-facing apps.

Answer

Azure AD B2C

Answer

Microsoft Entra Domain Services

Answer

Site-to-Site VPN

Question 4

Your organization is implementing Microsoft Defender for Identity to protect on-premises Active Directory. Which THREE activities does Defender for Identity monitor?

Accepted Answer

Privilege escalation attempts. Option A, C, and D are correct. Defender for Identity monitors lateral movement paths, reconnaissance attacks, and privilege escalation. Option B is wrong because file integrity monitoring is a feature of Defender for Servers or Azure Policy. Option E is wrong because network traffic to internet is monitored by Defender for Network or network security groups.

Answer

File integrity changes on domain controllers

Answer

Network traffic to external IP addresses

Question 5

You are designing a security solution for Azure resources using Azure Policy. You need to ensure that all storage accounts enforce HTTPS traffic and that only certain virtual networks can access them. Which THREE policy effects can you use to achieve this?

Accepted Answer

DeployIfNotExists. Option A, D, and E are correct. Deny prevents creation of non-compliant resources, Audit logs non-compliant resources, and DeployIfNotExists can deploy network rules. Option B is wrong because Append adds to existing resources but not for network rules. Option C is wrong because Modify changes properties, but not suitable for enforcing HTTPS.

Answer

Append

Answer

Modify

Question 6

Refer to the exhibit. You are reviewing an Azure Policy definition. What does this policy do?

Accepted Answer

Denies virtual machines with managed disks if the OS disk type is not Standard_LRS or Premium_LRS. Option D is correct. The policy rule denies virtual machines if the OS disk managed disk storage account type is not Standard_LRS or Premium_LRS. It checks if the VM uses managed disks, and if so, only allows Standard_LRS or Premium_LRS. Option A is wrong because it does not deny all VMs, only those with non-allowed disk types. Option B is wrong because it does not allow any disk type. Option C is wrong because it does not require encryption.

Answer

Requires all virtual machines to use encryption at host

Answer

Allows only virtual machines with unmanaged disks

Answer

Denies all virtual machines without managed disks

Question 7

Refer to the exhibit. You run the PowerShell command against an Azure SQL Database. The command returns a baseline object for rule VA2108. What does this indicate about the database's vulnerability assessment configuration?

Accepted Answer

The security team has approved the current state of rule VA2108 as acceptable. Option C is correct. The presence of a baseline for rule VA2108 means that previous findings for that rule have been approved, so the rule will not be flagged as a vulnerability in future scans. Option A is wrong because it does not mean automatic remediation. Option B is wrong because a baseline is set for specific rules, not all. Option D is wrong because vulnerability assessment is still enabled.

Answer

The vulnerability assessment scan is automatically remediating findings for rule VA2108

Answer

Vulnerability assessment is disabled for this database

Answer

The database has no vulnerability findings

Question 8

Refer to the exhibit. You are deploying an ARM template that creates a network security group (NSG) named nsg-backend. What is the effect of this NSG on inbound traffic?

Accepted Answer

Only inbound traffic from 10.0.1.0/24 on port 80 is allowed; all other inbound traffic is denied. Option B is correct. The NSG has two rules: AllowHTTPFromFrontend with priority 100 allows TCP 80 from 10.0.1.0/24, and DenyAllInbound with priority 1000 denies all other inbound traffic. Since the allow rule has a higher priority (lower number), traffic from the frontend subnet on port 80 is allowed, and all other inbound traffic is denied. Option A is wrong because traffic from 10.0.1.0/24 on port 80 is allowed. Option C is wrong because the explicit deny rule exists. Option D is wrong because the deny rule is not the only rule.

Answer

Only inbound traffic on port 80 is denied

Answer

All inbound traffic is allowed because no default deny rule is present

Answer

All inbound traffic is allowed except from 10.0.1.0/24

Question 9

Your organization plans to deploy Microsoft Defender for Cloud to protect hybrid workloads. You need to design the agentless scanning deployment for Azure VMs running SQL Server. What should you configure?

Accepted Answer

In Microsoft Defender for Cloud, enable the 'defenderForSql' plan and set the 'agentlessScanning' property to 'true'.. Agentless scanning for SQL Server on Azure VMs is enabled via defenderForSql in the Defender plan, not via Azure Policy or SQL Vulnerability Assessment. Option C is correct because it directly enables agentless scanning. Option A is wrong because Azure Policy can enforce scanning but is not the configuration mechanism. Option B is wrong because SQL Vulnerability Assessment is a separate feature. Option D is wrong because just enabling Defender for Cloud does not automatically scan SQL.

Answer

Deploy the Log Analytics agent on each SQL Server VM.

Answer

Enable SQL Vulnerability Assessment in Microsoft Defender for Cloud.

Answer

Configure Azure Policy to assign the 'Enable Defender for Cloud for SQL Servers' initiative.

Question 10

You are designing a secure access strategy for a manufacturing plant using Azure IoT Hub and Azure Defender for IoT. The plant has unpatched legacy PLCs that cannot be updated. What is the best approach to prevent these devices from being compromised and used as an entry point into the corporate network?

Accepted Answer

Implement network micro-segmentation using Azure Firewall and NSGs to isolate the PLCs from the corporate network.. Option D is correct because micro-segmentation with network security groups (NSGs) and Azure Firewall isolates the legacy devices, limiting lateral movement. Option A is wrong because unpatched devices cannot be hardened with Defender for IoT agents. Option B is wrong because TLS is often not supported on legacy PLCs. Option C is wrong because VPN would expose the devices to more traffic.

Answer

Use Azure VPN Gateway to connect PLCs to the virtual network.

Answer

Install the Microsoft Defender for IoT micro-agent on each PLC.

Answer

Enforce TLS 1.2 for all PLC communications.

Question 11

Your company uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate Exchange Online mailboxes. Which conditional access policy setting should you configure?

Accepted Answer

Grant: Require device to be marked as compliant.. Option B is correct because the 'Require device to be marked as compliant' grant condition enforces compliance. Option A is wrong because requiring multifactor authentication does not check device compliance. Option C is wrong because requiring Intune enrollment is part of compliance but not the compliance state itself. Option D is wrong because approved client app is for app protection policies.

Answer

Grant: Require approved client app.

Answer

Grant: Require multifactor authentication.

Answer

Grant: Require Intune enrollment.

Question 12

You are designing a backup strategy for a Microsoft 365 tenant. You need to ensure that Exchange Online mailbox items deleted by users can be recovered up to 30 days after deletion, without using third-party tools. What should you configure?

Accepted Answer

Enable single item recovery for the mailbox.. Option A is correct because single item recovery in Exchange Online allows recovery of deleted items up to 30 days. Option B is wrong because litigation hold preserves items indefinitely, not recovery after deletion. Option C is wrong because retention policies are for retention, not recovery. Option D is wrong because Azure Backup for Microsoft 365 is a third-party-like feature (actually Microsoft but not the simplest built-in).

Answer

Place the mailbox on litigation hold.

Answer

Create a Microsoft 365 retention policy for Exchange mailboxes.

Answer

Configure Azure Backup for Microsoft 365.

Question 13

You are designing a secure solution for an Azure Kubernetes Service (AKS) cluster that hosts a critical application. You need to ensure that pods can only communicate with specific back-end services and that traffic is encrypted. What should you implement?

Accepted Answer

Implement Kubernetes network policies and enable mTLS using a service mesh like Istio or Linkerd.. Option C is correct because network policies in AKS control pod-to-pod communication, and mutual TLS (mTLS) with a service mesh encrypts traffic. Option A is wrong because Azure Firewall controls ingress/egress, not pod-to-pod. Option B is wrong because NSGs are for subnet-level, not pod-level. Option D is wrong because App Gateway is for ingress.

Answer

Use network security groups (NSGs) on the subnet.

Answer

Configure Azure Application Gateway Ingress Controller.

Answer

Deploy Azure Firewall and configure application rules.

Question 14

Your organization is migrating on-premises Active Directory to Microsoft Entra ID. You need to design the authentication method to support hybrid identities with seamless single sign-on (SSO) for legacy applications that require Kerberos authentication. What should you implement?

Accepted Answer

Enable Microsoft Entra Seamless SSO via Microsoft Entra Connect.. Option D is correct because Microsoft Entra Connect with Seamless SSO enables Kerberos-based authentication for hybrid users. Option A is wrong because federation with ADFS is not required for Kerberos. Option B is wrong because PHS does not support Kerberos delegation. Option C is wrong because PTA does not support Kerberos.

Answer

Federate Microsoft Entra ID with on-premises Active Directory using ADFS.

Answer

Use password hash synchronization (PHS) only.

Answer

Deploy pass-through authentication (PTA).

Question 15

Your company uses Microsoft Sentinel as a SIEM. You need to ensure that all Azure subscription activity logs are ingested into Sentinel. What is the most efficient way to configure this?

Accepted Answer

Enable the 'Azure Activity' data connector in Sentinel.. Option B is correct because the data connector for Azure Activity is designed for this purpose. Option A is wrong because manual export is not efficient. Option C is wrong because diagnostic settings export to a Log Analytics workspace, but Sentinel requires the data connector. Option D is wrong because Logic Apps are unnecessary overhead.

Answer

Configure diagnostic settings on the subscription to send logs to a Log Analytics workspace.

Answer

Create an Azure Logic App to periodically pull activity logs.

Answer

Manually export activity logs to a storage account and connect to Sentinel.