SC-100 Design security solutions for infrastructure Practice Test 11 — 15 Questions

Question 1

Your organization is planning to deploy a new web application on Azure VMs. The security team requires that all incoming traffic to the VMs be inspected by a network virtual appliance (NVA) before reaching the VMs. Which Azure networking solution should you use to route traffic through the NVA?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

User Defined Routes (UDRs). User Defined Routes (UDRs) allow you to override Azure's default routing to force traffic through an NVA. Option A is wrong because Azure Firewall is a managed firewall service, not a routing mechanism. Option B is wrong because Azure Load Balancer distributes traffic but does not enforce routing through an NVA. Option C is wrong because Network Security Groups (NSGs) filter traffic but do not route it.

Answer

Azure Firewall

Answer

Azure Load Balancer

Answer

Network Security Groups (NSGs)

Question 2

A company uses Azure Arc to manage on-premises servers. The security team wants to enforce that all servers (on-premises and Azure) have Microsoft Defender for Endpoint installed and running. Which solution should you use to ensure compliance across hybrid environments?

Accepted Answer

Azure Policy with Guest Configuration. Azure Policy with Guest Configuration can audit and enforce configurations on Azure Arc-enabled servers, ensuring that Microsoft Defender for Endpoint is installed and running across hybrid environments. Option A is incorrect because Microsoft Intune is primarily for mobile device management, not for enforcing server configurations. Option C is wrong because Microsoft Defender for Cloud provides security recommendations but does not enforce compliance. Option D is wrong because Azure Update Manager focuses on patching, not endpoint protection enforcement.

Answer

Microsoft Intune

Answer

Azure Update Manager

Answer

Microsoft Defender for Cloud

Question 3

Your organization has a multi-region Azure deployment with ExpressRoute connections to on-premises. You need to design a solution that ensures all traffic between on-premises and Azure is inspected by a firewall for both inbound and outbound connections. The solution must minimize latency and avoid a single point of failure. What design should you recommend?

Accepted Answer

Deploy Azure Firewall in each region with forced tunneling enabled. Deploying Azure Firewall in each region with forced tunneling ensures all traffic between on-premises and Azure is inspected by a firewall, minimizes latency because traffic is inspected locally, and avoids a single point of failure by using multiple firewalls. Option B is incorrect because a single central hub creates a single point of failure and adds latency. Option C is incorrect because NSGs filter traffic based on rules but do not provide stateful inspection. Option D is incorrect because a third-party NVA in a single hub introduces a single point of failure and higher latency.

Answer

Deploy Azure Firewall in one central hub region and route all traffic through it

Answer

Use Network Security Groups (NSGs) on subnets to filter traffic

Answer

Deploy a third-party NVA in a hub-and-spoke topology with a single hub

Question 4

Refer to the exhibit. The NSG is applied to a subnet containing a web server. The web server is not receiving HTTP traffic. What is the most likely cause?

Accepted Answer

The sourceAddressPrefix 'Internet' does not include all source IPs. The 'Internet' service tag in Azure NSG rules only includes public IP address ranges. If the HTTP traffic originates from a private IP address—such as from an on-premises network connected via VPN or ExpressRoute, or from a peered VNet—it will not match the 'Internet' tag and will be dropped by the default deny rule. Therefore, the most likely cause is that the source address prefix does not cover the actual source IPs of the incoming traffic.

Answer

The DenyAllOther rule has a lower priority than AllowHTTP

Answer

The rule direction is Inbound, but the traffic is outbound

Answer

The priority of the AllowHTTP rule is too low (100)

Question 5

A company is implementing a zero-trust network for their Azure environment. They want to ensure that only authenticated and authorized users can access specific VMs, regardless of network location. Which Azure service should they use?

Accepted Answer

Azure Bastion. (Azure Bastion) is correct because it provides secure, RDP/SSH access to VMs without public IPs, and integrates with Entra ID for authentication, aligning with zero-trust principles. Option A (Just-in-Time VM Access) reduces exposure but still requires a public IP, violating zero-trust. Option C (Site-to-Site VPN) requires network connectivity, not user authentication. Option D (Network Security Groups) filter by IP, not user identity.

Answer

Just-in-Time (JIT) VM Access

Answer

Site-to-Site VPN

Answer

Network Security Groups (NSGs)

Question 6

Your organization uses Microsoft Sentinel to monitor security events. You need to design a solution that alerts when a user account is created and then used to log in from a different country within 1 hour. Which KQL query structure should you use?

Accepted Answer

Use a join operation on AccountName with a time window. A join operation on AccountName and a time window can correlate account creation and login events. Option A is wrong because a simple filter cannot correlate two events. Option B is wrong because a summarize with timechart shows aggregation, not specific account correlation. Option D is wrong because a union just combines tables, no correlation.

Answer

Use a single table filter with where clause

Answer

Use summarize with timechart

Answer

Use union to combine events

Question 7

Your company uses Azure DevOps to deploy infrastructure. You need to ensure that all deployed resources have specific tags for cost tracking. Which Azure policy effect should you use to prevent deployment of untagged resources?

Accepted Answer

Deny. The 'Deny' effect prevents creation of non-compliant resources. Option A is wrong because 'Disabled' turns off the policy. Option C is wrong because 'DeployIfNotExists' can add tags after creation but does not prevent deployment. Option D is wrong because 'Audit' only logs compliance, does not block.

Answer

Disabled

Answer

DeployIfNotExists

Answer

Audit

Question 8

A global company with branches worldwide wants to secure access to Azure resources using a zero-trust approach. They require that all access requests be authenticated, authorized, and encrypted, and that the user's device must be compliant with corporate policies. Which combination of services should they use?

Accepted Answer

Azure AD Conditional Access and Azure AD Application Proxy. Azure AD Conditional Access can enforce authentication, authorization, and device compliance, while Azure AD Application Proxy provides secure remote access to on-premises applications, supporting a zero-trust approach. Option A is wrong because Azure VPN Gateway provides network-level connectivity but does not enforce device compliance or detailed access policies; Azure AD Multi-Factor Authentication alone is insufficient. Option C is wrong because Azure Firewall is a network security service that does not handle authentication or device compliance, and Azure AD Password Protection only deals with password policies. Option D is wrong because Azure AD B2C is designed for external customer identities, not for internal employee access to Azure resources.

Answer

Azure VPN Gateway and Azure AD Multi-Factor Authentication

Answer

Azure Firewall and Azure AD Password Protection

Answer

Azure AD B2C and Azure AD Identity Protection

Question 9

Which TWO of the following are valid methods to secure Azure Kubernetes Service (AKS) workloads?

Accepted Answer

Integrate Azure AD for cluster authentication. Integrating Azure AD with AKS enables authentication and authorization for cluster access. Option E is correct because Azure Policy with Gatekeeper (Azure Policy for AKS) allows enforcing security policies on AKS workloads, such as pod security constraints. Option B is wrong because Network Security Groups apply to subnets and VMs, not directly to pod subnets; pod-level security is managed via Kubernetes Network Policies. Option C is wrong because Azure Firewall is a network-level firewall for perimeter security, not specifically for securing AKS workloads. Option D is wrong because Azure Front Door is a global load balancer and application delivery service, not designed for workload-level security.

Answer

Apply Network Security Groups to pod subnets

Answer

Deploy Azure Firewall in front of the AKS cluster

Answer

Use Azure Front Door to protect API endpoints

Question 10

Which THREE of the following are best practices for designing a secure hybrid network architecture with Azure?

Accepted Answer

Use Azure Bastion for secure VM access without public IPs. Azure Bastion provides secure, managed RDP/SSH access to virtual machines without exposing public IP addresses, reducing the attack surface. Option C is correct because ExpressRoute offers a dedicated private connection to Azure, and combining it with Azure Firewall enables traffic inspection, logging, and policy enforcement. Option E is correct because forced tunneling directs all internet-bound traffic from the virtual network to on-premises via VPN or ExpressRoute for centralized inspection and policy enforcement. Option B is incorrect because opening all ports to a management subnet violates the principle of least privilege and increases security risk. Option D is incorrect because using a single VPN gateway for all regions creates a single point of failure; a resilient design should use multiple gateways or redundant connections.

Answer

Open all ports to a management subnet for ease of administration

Answer

Use a single VPN gateway for all regions

Question 11

Which TWO of the following are features of Azure DDoS Protection?

Accepted Answer

Cost protection for scaled resources during an attack. Azure DDoS Protection offers cost protection for scaled resources during an attack (option A) and adaptive tuning and mitigation of DDoS attacks (option E). Option B is incorrect because WAF capabilities are provided by Azure Web Application Firewall, not DDoS Protection. Option C is incorrect because site-to-site VPN is a feature of Azure VPN Gateway. Option D is incorrect because SSL termination and offloading are handled by Azure Application Gateway or other load balancers.

Answer

Web application firewall (WAF) capabilities

Answer

Site-to-site VPN connectivity

Answer

SSL termination and offloading

Question 12

Refer to the exhibit. A company applies this Azure Policy to their subscription. An administrator tries to create a VM with a public IP address. What will happen?

Accepted Answer

The VM creation will be denied. The policy denies creation of network interfaces with a public IP, preventing the VM from being created. Option A is incorrect because the policy does not automatically remove the public IP; it denies the creation. Option C is incorrect because the policy is set to Deny, not Audit or Alert. Option D is incorrect because the policy applies to the entire subscription unless scoped otherwise.

Answer

The public IP will be automatically removed

Answer

The VM will be created, but an alert will be generated

Answer

The policy will only apply to VMs in a specific resource group

Question 13

Your organization uses Azure SQL Database with Azure AD authentication. You need to ensure that database administrators (DBAs) can only perform management tasks from a specific Azure region and only during business hours. Which solution should you use?

Accepted Answer

Azure AD Conditional Access policies. Azure AD Conditional Access can enforce location and time restrictions for Azure AD authenticated users. Option B is wrong because Azure RBAC with custom roles can only control permissions based on role assignments, not enforce location or time restrictions. Option C is wrong because Azure Policy cannot enforce time-based access. Option D is wrong because Azure SQL Database firewall rules filter by IP address, not user identity or time.

Answer

Azure RBAC with custom roles

Answer

Azure Policy with custom policy

Answer

Azure SQL Database firewall rules

Question 14

Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to ensure that user passwords are synchronized securely and that password changes on-premises are reflected in the cloud quickly. Which tool should you configure?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect synchronizes identities and password hashes from on-premises Active Directory to Microsoft Entra ID, ensuring password changes are reflected quickly. Option B is incorrect because Azure AD Connect is the older name for the same tool, but the current official name is Microsoft Entra Connect. Option C is incorrect because AD FS is used for federation, not password synchronization. Option D is incorrect because Microsoft Identity Manager handles identity governance and management, not direct password sync.

Answer

Azure AD Connect

Answer

Active Directory Federation Services (AD FS)

Answer

Microsoft Identity Manager

Question 15

Your organization is deploying Microsoft Defender for Cloud to secure a hybrid environment with workloads in Azure and on-premises. You need to ensure that all servers are covered by Defender for Cloud's plans. Which two actions should you take?

Accepted Answer

Install the Azure Connected Machine agent (Azure Arc) on on-premises servers.. Installing the Azure Connected Machine agent (Azure Arc) on on-premises servers brings them under Azure's management, allowing Defender for Cloud to extend coverage to those servers. Option C is correct because enabling the Defender for Cloud plans (e.g., Defender for Servers) on the Azure subscription ensures that both Azure VMs and on-premises servers (via Arc) are protected by the advanced security features. Option B is incorrect because enabling only the foundational CSPM provides basic security posture assessments but does not include server-specific protections. Option D is incorrect because the Azure Monitor Agent is not required for Defender for Cloud coverage; it is used for advanced data collection and monitoring.

Answer

Enable only the foundational cloud security posture management (CSPM) on the subscription.

Answer

Deploy the Azure Monitor Agent to all on-premises servers.