SC-100 Design security solutions for infrastructure Practice Test 10 — 15 Questions

Question 1

You are designing a secure access solution for an on-premises application that uses legacy authentication protocols. The organization plans to migrate to Microsoft Entra ID but the application vendor has not yet provided a modern authentication update. The solution must enable single sign-on (SSO) and support multifactor authentication (MFA) for this application without modifying the application code. Which approach should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy Microsoft Entra Application Proxy with pre-authentication. Microsoft Entra Application Proxy with pre-authentication (option D) is correct because it publishes the on-premises legacy application externally while enforcing Microsoft Entra ID authentication and MFA at the proxy before traffic reaches the app, enabling SSO without changing application code. Pre-authentication means users authenticate against Microsoft Entra ID first, so legacy protocols inside the app are shielded and MFA/Conditional Access can be applied. MSAL (A) requires modifying the application to use modern auth libraries, which the vendor has not provided. Federating on-premises AD with Entra ID (B) only enables identity synchronization/federation and does not by itself provide SSO or MFA for a legacy on-premises app. Conditional Access policies (C) require the app to already authenticate with Entra ID and cannot protect an app that still uses legacy authentication directly.

Answer

Integrate the application with the Microsoft Authentication Library (MSAL)

Answer

Federate the on-premises Active Directory with Microsoft Entra ID

Answer

Use Microsoft Entra Conditional Access policies to require MFA

Question 2

Your organization uses Microsoft Intune to manage endpoints. The security team wants to ensure that devices that cannot be enrolled in Intune (e.g., unmanaged BYOD devices) are still subject to security policies when accessing corporate resources. Which Microsoft Entra ID feature should you use?

Accepted Answer

Microsoft Entra Conditional Access policies. Microsoft Entra Conditional Access policies (option A) are correct because they evaluate signals such as user, device state, and location at authentication time and can enforce controls like requiring MFA or compliant devices even for unmanaged BYOD endpoints that cannot be enrolled in Intune. Conditional Access can block or restrict access to corporate resources for devices that don't meet policy, which directly addresses the scenario. Intune enrollment policies (B) only apply to devices being enrolled and cannot govern unenrolled devices. Windows Defender Application Control (C) is an application control mechanism on Windows endpoints, not an access policy for corporate resources. Microsoft Defender for Endpoint (D) is an endpoint detection and response platform, not the feature that enforces access policy for unmanaged devices.

Answer

Microsoft Intune enrollment policies

Answer

Windows Defender Application Control

Answer

Microsoft Defender for Endpoint

Question 3

Which TWO Azure services can you use to implement a zero-trust network architecture that verifies identity and device compliance before granting access to on-premises applications? (Choose two.)

Accepted Answer

Microsoft Entra Application Proxy. Microsoft Entra Application Proxy (A) is correct because it publishes on-premises web applications to the cloud and enforces Microsoft Entra ID authentication and Conditional Access before any request is forwarded to the internal app, which directly supports verifying identity and device compliance for on-premises access. Microsoft Entra Conditional Access (B) is correct because it is the policy engine that evaluates signals such as user identity, group membership, and device compliance state (via Intune) and then grants, blocks, or challenges access, which is the core of a zero-trust verification step. Azure VPN Gateway (C) only establishes encrypted network tunnels and does not itself verify user identity or device compliance. Azure Firewall (D) is a network-layer traffic filtering and inspection service, not an identity or device-compliance gate. Azure Bastion (E) provides secure RDP/SSH access to Azure VMs over TLS without exposing public IPs, but it does not publish or broker access to on-premises applications based on identity and device compliance.

Answer

Azure VPN Gateway

Answer

Azure Firewall

Answer

Azure Bastion

Question 4

You are designing a secure hybrid network architecture for a company that uses Azure and an on-premises datacenter. The company requires that all traffic between Azure and on-premises traverses Microsoft's backbone network and never the public internet. Additionally, the solution must provide automatic failover if the primary connection fails. Which Azure service should you include in the design?

Accepted Answer

Azure ExpressRoute with redundant circuits. Azure ExpressRoute with redundant circuits is correct because ExpressRoute provides a private, dedicated connection through a connectivity provider that does not traverse the public internet, and deploying two or more circuits in different peering locations enables automatic failover if the primary circuit fails. Azure Virtual WAN is a networking hub service that can aggregate connectivity but does not by itself guarantee private backbone-only transport or automatic failover. Azure Front Door is a global HTTP/HTTPS load balancer and CDN for web applications, not a hybrid connectivity service. Azure VPN Gateway sends traffic over the public internet via IPsec tunnels, so it fails the requirement that traffic never use the public internet.

Answer

Azure Virtual WAN

Answer

Azure Front Door

Answer

Azure VPN Gateway

Question 5

Your company has a Microsoft Defender for Cloud environment with Azure Arc-enabled on-premises servers. The security team wants to ensure that all servers have the Log Analytics agent installed and that missing updates are automatically remediated for critical vulnerabilities. Which policy initiative should you assign to the management group containing these servers?

Accepted Answer

Azure Security Benchmark. The Azure Security Benchmark initiative includes policies for agent installation and vulnerability remediation. The other options are either not policy initiatives or focus on different aspects like container security or regulatory compliance.

Answer

Azure Policy for Kubernetes

Answer

CIS Microsoft Azure Foundations Benchmark

Answer

NIST SP 800-53 R5

Question 6

A multinational corporation is designing a secure access solution for remote employees using company-managed devices. The solution must enforce device compliance before granting access to corporate resources, support single sign-on (SSO) for SaaS applications, and provide conditional access policies based on risk. Which combination of Microsoft security products should you recommend?

Accepted Answer

Microsoft Intune + Microsoft Entra ID + Microsoft Defender for Cloud Apps. Microsoft Intune provides device compliance, Microsoft Entra ID provides SSO and conditional access, and Microsoft Defender for Cloud Apps provides risk-based access control. The other combinations miss key components.

Answer

Microsoft Intune + Microsoft Defender for Endpoint + Microsoft Sentinel

Answer

Microsoft Entra ID + Microsoft Defender for Cloud Apps + Microsoft Purview

Answer

Microsoft Configuration Manager + Microsoft Entra ID + Microsoft Defender for Identity

Question 7

Your organization is implementing a zero-trust network strategy. You need to ensure that all network traffic between Azure virtual machines is encrypted and authenticated at the IP layer, regardless of the virtual network they are in. Which Azure feature should you configure?

Accepted Answer

Azure Virtual Network encryption. Azure Virtual Network encryption provides IPsec encryption for traffic between VMs within the same virtual network or peered virtual networks. Service endpoints use public IPs. Private Link is for accessing PaaS services privately. VPN Gateway is for site-to-site.

Answer

Azure Service Endpoints

Answer

Azure VPN Gateway

Answer

Azure Private Link

Question 8

Refer to the exhibit. You are reviewing an Azure Policy definition that is assigned to a subscription. What is the primary effect of this policy?

Accepted Answer

It modifies the OS disk to use a specific disk encryption set.. The policy uses the 'modify' effect to add or replace the disk encryption set ID on any virtual machine's OS disk managed disk. This ensures VMs use a specific encryption set. 'deployIfNotExists' would deploy a resource, 'audit' would only log, 'deny' would block creation.

Answer

It deploys a disk encryption set to each virtual machine.

Answer

It denies creation of virtual machines without the specified disk encryption set.

Answer

It audits virtual machines that do not use the specified disk encryption set.

Question 9

Your company is migrating to a cloud-native security operations center (SOC) using Microsoft Sentinel. You need to design a solution that automatically investigates and remediates common incidents like brute-force attacks on Azure VMs. The solution should use playbooks triggered by analytics rules. Which Microsoft service should you use to create the playbooks, and what is the recommended authentication method?

Accepted Answer

Azure Logic Apps with managed identity. Azure Logic Apps is the recommended platform for Sentinel playbooks. Managed identity is the preferred authentication method because it avoids credential management and supports automation. Azure Automation is for runbooks, not playbooks. Service principal is possible but not recommended due to credential management.

Answer

Power Automate with user account

Answer

Azure Automation with service principal

Answer

Azure Functions with API key

Question 10

A company is designing a secure baseline for Azure VMs using Azure Policy and Microsoft Defender for Cloud. Which TWO recommendations should you include to ensure VMs are protected against common threats?

Accepted Answer

Deploy the Log Analytics agent on all VMs. Enabling just-in-time (JIT) VM access reduces attack surface by blocking inbound traffic to management ports. Deploying the Log Analytics agent is required for Defender for Cloud to collect security data. The other options are either not security baselines or not VM-specific.

Answer

Configure Azure Backup for all VMs

Answer

Enable Azure Site Recovery

Answer

Use Azure Disk Encryption with Azure Key Vault

Question 11

Your organization plans to use Microsoft Defender for Cloud to protect a hybrid environment with servers in Azure and on-premises. You need to ensure that security policies are consistently applied across all servers. What should you configure?

Accepted Answer

Onboard all servers to Azure Arc and assign Defender for Cloud policies.. Option A is correct because onboarding on-premises and Azure servers to Azure Arc makes them manageable as connected machine resources in Azure, allowing Defender for Cloud policies and plans (such as Defender for Servers) to be applied consistently across the hybrid estate. Azure Arc is the supported mechanism for extending Azure management and Defender for Cloud coverage to non-Azure servers. Option B is wrong because Azure Automation State Configuration (DSC) enforces configuration state, not Defender for Cloud security policies. Option C is wrong because Microsoft Sentinel is a SIEM/SOAR solution for analytics and detection, not policy assignment. Option D is wrong because Azure Policy guest configuration audits/configures in-guest settings but does not itself onboard servers to Defender for Cloud or apply its security plans.

Answer

Deploy Azure Automation State Configuration (DSC) to all servers.

Answer

Connect all servers to Microsoft Sentinel and use analytics rules.

Answer

Use Azure Policy with guest configuration on all servers.

Question 12

You are designing a secure hybrid network for a multinational company. They require encrypted communication between on-premises data centers and Azure, with high availability and no single point of failure. Which solution should you recommend?

Accepted Answer

Deploy ExpressRoute with a site-to-site VPN as a failover.. Option A is correct because ExpressRoute provides a private, high-bandwidth dedicated connection to Azure, and pairing it with a site-to-site VPN failover ensures encrypted traffic and eliminates a single point of failure if the ExpressRoute circuit goes down. The VPN failover also satisfies the encryption requirement since ExpressRoute by itself does not encrypt data in transit. Option B provides encryption and redundancy but relies solely on internet-based VPN, which lacks the dedicated private connectivity and predictable performance of ExpressRoute. Option C is wrong because point-to-site VPN is designed for individual client devices, not data center-to-Azure connectivity. Option D is wrong because ExpressRoute without encryption does not meet the encrypted communication requirement, and relying only on Microsoft backbone security does not provide the required encryption or redundancy.

Answer

Deploy a site-to-site VPN over the internet with two active VPN devices.

Answer

Deploy Azure Virtual WAN with point-to-site VPN for each data center.

Answer

Deploy ExpressRoute without encryption and rely on Microsoft backbone security.

Question 13

Your company uses Microsoft Entra ID for identity management. You need to implement a solution to automatically detect and remediate risky sign-ins using machine learning. What should you configure?

Accepted Answer

Configure Microsoft Entra ID Protection and enable risk-based policies.. Microsoft Entra ID Protection is the correct choice (Option C) because it uses machine learning to detect risky sign-ins and user risk events, and it lets you enable risk-based Conditional Access policies that automatically remediate those risks (for example, requiring MFA or blocking access). It is purpose-built for identity risk detection and automated remediation, matching the scenario's requirement exactly. Option A, Entra Connect, only synchronizes on-premises identities to Entra ID and does not perform risk detection. Option B, Conditional Access with session controls, enforces access and session restrictions but does not itself provide the machine-learning risk detection engine. Option D, PIM, manages just-in-time privileged role activation and approvals, not risky sign-in detection or remediation.

Answer

Configure Microsoft Entra Connect to sync on-premises identities.

Answer

Configure Conditional Access policies with session controls.

Answer

Configure Privileged Identity Management (PIM) for admin roles.

Question 14

You are designing a security solution for Azure Kubernetes Service (AKS). You need to ensure that only authorized container images from a private container registry can run in the cluster. What should you configure?

Accepted Answer

Use Azure Policy to enforce that containers run only from allowed registries.. Azure Policy is the correct choice (A) because it can enforce admission-time constraints on an AKS cluster, such as an allowed-registries policy that denies pods whose images do not originate from the specified private Azure Container Registry. This directly satisfies the requirement that only authorized images from a private registry can run. Option B is incorrect because ACR Tasks scan images for vulnerabilities but do not restrict which registries pods may pull from. Option C is incorrect because network policies control pod-level traffic, not image provenance, and blocking outbound traffic does not enforce registry allowlisting. Option D is incorrect because Microsoft Defender for Containers provides threat detection and posture management, not admission control that blocks unauthorized images.

Answer

Implement Azure Container Registry tasks to scan images.

Answer

Configure network policies in AKS to block outbound traffic to public registries.

Answer

Enable Microsoft Defender for Containers to block unauthorized images.

Question 15

Which TWO actions should you take to protect Azure Virtual Machines from ransomware? (Choose two.)

Accepted Answer

Enable Azure Backup with immutable vault.. Option C is correct because Azure Backup with an immutable vault prevents backup data from being altered or deleted during the retention period, which is essential for recovering VMs after a ransomware attack encrypts or destroys production data. Option E is correct because Microsoft Defender for Servers provides threat detection, vulnerability assessment, and file integrity monitoring, and it can raise alerts on suspicious ransomware-like behavior on the VM. Option A is not correct because blocking all inbound traffic with Azure Firewall would not stop ransomware delivered through outbound connections, compromised credentials, or already-running workloads, and it is not a ransomware-specific protection. Option B is not correct because Azure Site Recovery provides replication and disaster recovery failover, but it does not by itself protect backups from tampering or detect ransomware. Option D is not correct because encryption at rest protects data confidentiality if disks are stolen, but it does not prevent ransomware from encrypting files on a running VM.

Answer

Deploy Azure Firewall to block all inbound traffic.

Answer

Configure Azure Site Recovery for all VMs.

Answer

Assign Azure Policy to require encryption at rest.