SC-100 Design security solutions for infrastructure Practice Test 10 — 15 Questions

Question 1

Your organization plans to deploy Microsoft Defender for Cloud to protect hybrid workloads. You need to design the agentless scanning deployment for Azure VMs running SQL Server. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In Microsoft Defender for Cloud, enable the 'defenderForSql' plan and set the 'agentlessScanning' property to 'true'.. Agentless scanning for SQL Server on Azure VMs is enabled directly through the Defender for Cloud plan configuration. Setting the 'defenderForSql' plan to 'On' with 'agentlessScanning' set to 'true' enables scanning without agents. Option A is the correct configuration. Option B is incorrect because the Log Analytics agent is not required for agentless scanning. Option C is incorrect because SQL Vulnerability Assessment is a separate feature that can be enabled but does not itself enable scanning. Option D is incorrect because Azure Policy can enforce the plan assignment but is not the direct method to enable agentless scanning.

Answer

Deploy the Log Analytics agent on each SQL Server VM.

Answer

Enable SQL Vulnerability Assessment in Microsoft Defender for Cloud.

Answer

Configure Azure Policy to assign the 'Enable Defender for Cloud for SQL Servers' initiative.

Question 2

You are designing a secure access strategy for a manufacturing plant using Azure IoT Hub and Azure Defender for IoT. The plant has unpatched legacy PLCs that cannot be updated. What is the best approach to prevent these devices from being compromised and used as an entry point into the corporate network?

Accepted Answer

Implement network micro-segmentation using Azure Firewall and NSGs to isolate the PLCs from the corporate network.. Network micro-segmentation using Azure Firewall and NSGs isolates the unpatched legacy PLCs from the corporate network, preventing lateral movement in case of compromise. Option A is incorrect because a VPN gateway would connect the PLCs to the virtual network, increasing exposure. Option C is incorrect because legacy PLCs typically cannot run the Defender for IoT micro-agent. Option D is incorrect because these devices often do not support TLS 1.2 and enforcing it would disrupt communication.

Answer

Use Azure VPN Gateway to connect PLCs to the virtual network.

Answer

Install the Microsoft Defender for IoT micro-agent on each PLC.

Answer

Enforce TLS 1.2 for all PLC communications.

Question 3

Your company uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate Exchange Online mailboxes. Which conditional access policy setting should you configure?

Accepted Answer

Grant: Require device to be marked as compliant.. The 'Require device to be marked as compliant' grant control in Conditional Access ensures that only devices meeting your Intune compliance policies can access Exchange Online. Option B (Require approved client app) is for app protection policies, not device compliance. Option C (Require multifactor authentication) addresses authentication strength, not compliance. Option D (Require Intune enrollment) ensures enrollment but not the compliance state itself; a device can be enrolled yet non-compliant.

Answer

Grant: Require approved client app.

Answer

Grant: Require multifactor authentication.

Answer

Grant: Require Intune enrollment.

Question 4

You are designing a backup strategy for a Microsoft 365 tenant. You need to ensure that Exchange Online mailbox items deleted by users can be recovered up to 30 days after deletion, without using third-party tools. What should you configure?

Accepted Answer

Enable single item recovery for the mailbox.. Single Item Recovery (SIR) in Exchange Online allows users to recover deleted items from the Recoverable Items folder for up to 30 days (default) without third-party tools. Option A is wrong because litigation hold preserves all mailbox content indefinitely, but it does not enable recovery of accidentally deleted items by the user; it is for eDiscovery. Option B is wrong because retention policies are designed to retain or delete content after a specified period, not for immediate recovery of deleted items. Option D is wrong because Azure Backup for Microsoft 365 is a third-party-like service (though Microsoft-owned) and is not the built-in feature for simple recovery of deleted items within 30 days.

Answer

Place the mailbox on litigation hold.

Answer

Create a Microsoft 365 retention policy for Exchange mailboxes.

Answer

Configure Azure Backup for Microsoft 365.

Question 5

You are designing a secure solution for an Azure Kubernetes Service (AKS) cluster that hosts a critical application. You need to ensure that pods can only communicate with specific back-end services and that traffic is encrypted. What should you implement?

Accepted Answer

Implement Kubernetes network policies and enable mTLS using a service mesh like Istio or Linkerd.. Kubernetes network policies allow you to restrict pod-to-pod communication to specific back-end services, and mutual TLS (mTLS) from a service mesh like Istio or Linkerd encrypts the traffic. Option B is incorrect because network security groups (NSGs) operate at the subnet level and cannot enforce pod-level network policies. Option C is incorrect because Azure Application Gateway Ingress Controller handles inbound traffic from outside the cluster, not pod-to-pod communication. Option D is incorrect because Azure Firewall controls north-south traffic (ingress/egress) and does not manage east-west traffic between pods.

Answer

Use network security groups (NSGs) on the subnet.

Answer

Configure Azure Application Gateway Ingress Controller.

Answer

Deploy Azure Firewall and configure application rules.

Question 6

Your organization is migrating on-premises Active Directory to Microsoft Entra ID. You need to design the authentication method to support hybrid identities with seamless single sign-on (SSO) for legacy applications that require Kerberos authentication. What should you implement?

Accepted Answer

Enable Microsoft Entra Seamless SSO via Microsoft Entra Connect.. Microsoft Entra Connect with Seamless SSO enables Kerberos-based authentication for hybrid users. Option A is wrong because federation with ADFS is not required for Kerberos. Option B is wrong because PHS does not support Kerberos delegation. Option C is wrong because PTA does not support Kerberos.

Answer

Federate Microsoft Entra ID with on-premises Active Directory using ADFS.

Answer

Use password hash synchronization (PHS) only.

Answer

Deploy pass-through authentication (PTA).

Question 7

Your company uses Microsoft Sentinel as a SIEM. You need to ensure that all Azure subscription activity logs are ingested into Sentinel. What is the most efficient way to configure this?

Accepted Answer

Enable the 'Azure Activity' data connector in Sentinel.. The Azure Activity data connector is specifically designed to ingest subscription-level activity logs into Microsoft Sentinel. Option A is incorrect because although diagnostic settings can send activity logs to a Log Analytics workspace, Sentinel requires the data connector to properly collect and correlate the data. Option B is incorrect because an Azure Logic App would be an inefficient custom solution when a built-in connector exists. Option D is incorrect because manually exporting to a storage account is not efficient or automated.

Answer

Configure diagnostic settings on the subscription to send logs to a Log Analytics workspace.

Answer

Create an Azure Logic App to periodically pull activity logs.

Answer

Manually export activity logs to a storage account and connect to Sentinel.

Question 8

You are designing a secure DevOps pipeline for a critical application using GitHub Actions and Microsoft Defender for Cloud. You need to ensure that container images are scanned for vulnerabilities before being deployed to Azure Kubernetes Service (AKS). What should you implement?

Accepted Answer

Integrate Microsoft Defender for Containers with the CI/CD pipeline to scan images in Azure Container Registry.. Microsoft Defender for Containers integrates with CI/CD pipelines to scan container images in Azure Container Registry for vulnerabilities before deployment to AKS. Option B (GitHub Advanced Security) scans code for secrets and vulnerabilities, not container images. Option C (Azure Policy) can enforce compliance requirements but does not perform vulnerability scanning of container images. Option D (Azure Container Registry Tasks) automates image building and patching but does not scan images for vulnerabilities.

Answer

Enable GitHub Advanced Security for the repository.

Answer

Configure Azure Policy to require vulnerability assessment.

Answer

Use Azure Container Registry Tasks to build images.

Question 9

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that devices must have a minimum OS version and cannot be jailbroken. Which configuration profile type should you assign?

Accepted Answer

Compliance policy.. Compliance policy. Compliance policies in Microsoft Intune are used to define conditions that devices must meet to be considered compliant, such as minimum OS version and jailbreak status. Option A (Device configuration policy) is incorrect because it manages device settings and features, not compliance requirements. Option B (Device restrictions profile) is incorrect because it is a type of configuration policy that enforces specific restrictions, not compliance checks. Option C (Enrollment restriction) is incorrect because it controls which devices can enroll, not post-enrollment compliance.

Answer

Device configuration policy.

Answer

Device restrictions profile.

Answer

Enrollment restriction.

Question 10

Refer to the exhibit. You are reviewing an Azure Policy definition. What will this policy do when assigned to a subscription?

Accepted Answer

Prevent creation of virtual machines with OS disks that are not Premium SSD.. The policy definition evaluates the OS disk's SKU. If the OS disk is not Premium_LRS, the policy denies the creation of the VM. This ensures that only VMs with Premium SSD OS disks are allowed. Option A is incorrect because the policy does not deny all VMs; it only denies those with non-Premium SSD OS disks. Option B is incorrect because this policy uses 'Deny' effect, not 'Audit'. Option C is incorrect because the policy targets the OS disk, not data disks.

Answer

Deny creation of all virtual machines.

Answer

Audit existing virtual machines for compliance.

Answer

Enforce Premium SSD on data disks.

Question 11

Refer to the exhibit. You are reviewing a Microsoft Sentinel analytics rule in your workspace. The output shows the rule 'MFA Disabled' is enabled with severity Medium. The query returns events where MFA is absent. What is the primary issue with this rule?

Accepted Answer

The query does not include a time range, which will cause excessive alerts.. The query does not include a time range filter (e.g., 'TimeGenerated > ago(24h)'), which causes the rule to evaluate all historical events matching the condition, resulting in excessive alerts. Option A is wrong because the rule can be tuned by adding a time range rather than disabling it. Option B is wrong because severity classification depends on organizational policy and is not the primary issue. Option C is wrong because the trigger threshold is not the root cause; the lack of a time window makes the query too broad regardless of threshold.

Answer

The rule should be disabled until tuned.

Answer

The severity should be High.

Answer

The trigger threshold is too low.

Question 12

Refer to the exhibit. You are reviewing a Bicep template for deploying an Azure SQL Database server. Which security best practice is violated?

Accepted Answer

Administrator password is hardcoded in plain text.. Hardcoding the administrator password in plain text within a Bicep template violates security best practices. Passwords should be stored securely, such as in Azure Key Vault, and referenced dynamically. Option A is incorrect because setting minimal TLS version to 1.2 is actually a security best practice, not a violation. Option C is incorrect: disabling public network access is a security best practice to reduce exposure, and connectivity can still be achieved via private endpoints or Azure services. Option D is incorrect because Azure AD authentication is optional and not a requirement for security; the violation is the hardcoded password, not the lack of Azure AD auth.

Answer

Minimal TLS version is set to 1.2, which is acceptable.

Answer

Public network access is disabled, which may affect connectivity.

Answer

Azure AD authentication is not configured.

Question 13

Which TWO actions should you take to protect Azure Virtual Machines from ransomware attacks? (Choose two.)

Accepted Answer

Enable Azure Backup for all VMs.. Options B and E are correct. Azure Backup provides recovery capabilities in case of ransomware encrypting data, allowing restoration to a pre-attack state. Microsoft Defender Antivirus with real-time protection helps detect and block ransomware at the endpoint. Option A is incorrect because blocking all outbound traffic is too restrictive and breaks legitimate connectivity; it's not a ransomware-specific control. Option C is incorrect because auto-shutdown schedules do not prevent ransomware attacks. Option D is incorrect because disabling RDP reduces attack surface but does not directly protect against ransomware; it is a general security best practice.

Answer

Configure Azure Firewall to block all outbound traffic.

Answer

Use auto-shutdown schedules for VMs.

Answer

Disable RDP access from the internet.

Question 14

Which THREE components are required to implement a secure hybrid network architecture using Azure VPN Gateway? (Choose three.)

Accepted Answer

A local network gateway resource in Azure.. Options A, B, and D are correct. A local network gateway represents the on-premises VPN device configuration. A connection resource with a shared key ties the on-premises and Azure gateways together. A virtual network gateway (VPN Gateway) is the Azure-side endpoint. Option C (ExpressRoute) is a different connectivity method, not a component of a VPN gateway solution. Option E (Azure Firewall) is a security device but not required for a basic VPN connection.

Answer

An ExpressRoute circuit.

Answer

An Azure Firewall.

Question 15

Which TWO features of Microsoft Defender for Cloud help you identify and remediate misconfigurations in your Azure environment? (Choose two.)

Accepted Answer

Security recommendations.. Options B and E are correct. Security recommendations (B) provide actionable steps to fix misconfigurations, and Secure score (E) measures overall security posture and helps prioritize remediation efforts. Option A (File integrity monitoring) monitors changes to files and registries, not misconfigurations. Option C (Just-in-time VM access) manages VM access, not configuration issues. Option D (Adaptive application controls) controls which applications can run, not misconfigurations.

Answer

File integrity monitoring (FIM).

Answer

Just-in-time (JIT) VM access.

Answer

Adaptive application controls.