SC-100 Design security solutions for infrastructure Practice Test 11 — 15 Questions

Question 1

You are designing a secure DevOps pipeline for a critical application using GitHub Actions and Microsoft Defender for Cloud. You need to ensure that container images are scanned for vulnerabilities before being deployed to Azure Kubernetes Service (AKS). What should you implement?

Accepted Answer

Integrate Microsoft Defender for Containers with the CI/CD pipeline to scan images in Azure Container Registry.. Option C is correct because Defender for Cloud can scan container images in registries and integrate with CI/CD. Option A is wrong because GitHub Advanced Security scans code, not images. Option B is wrong because Azure Policy can enforce compliance but does not scan. Option D is wrong because Azure Container Registry Tasks build images but do not scan.

Answer

Enable GitHub Advanced Security for the repository.

Answer

Configure Azure Policy to require vulnerability assessment.

Answer

Use Azure Container Registry Tasks to build images.

Question 2

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that devices must have a minimum OS version and cannot be jailbroken. Which configuration profile type should you assign?

Accepted Answer

Compliance policy.. Option B is correct because compliance policies define requirements like OS version and jailbreak detection. Option A is wrong because device restrictions enforce settings, not compliance. Option C is wrong because configuration policies are for settings. Option D is wrong because enrollment restrictions apply during enrollment.

Answer

Device configuration policy.

Answer

Device restrictions profile.

Answer

Enrollment restriction.

Question 3

Refer to the exhibit. You are reviewing an Azure Policy definition. What will this policy do when assigned to a subscription?

Accepted Answer

Prevent creation of virtual machines with OS disks that are not Premium SSD.. Option A is correct because the policy denies creation of VMs whose OS disk is not Premium_LRS. Option B is wrong because it only denies if the OS disk type is not Premium_LRS, not all VMs. Option C is wrong because it checks OS disk, not data disks. Option D is wrong because it evaluates at creation time.

Answer

Deny creation of all virtual machines.

Answer

Audit existing virtual machines for compliance.

Answer

Enforce Premium SSD on data disks.

Question 4

Refer to the exhibit. You are reviewing a Microsoft Sentinel analytics rule in your workspace. The output shows the rule 'MFA Disabled' is enabled with severity Medium. The query returns events where MFA is absent. What is the primary issue with this rule?

Accepted Answer

The query does not include a time range, which will cause excessive alerts.. Option C is correct because the query is too broad and will generate excessive alerts (no time filter). Option A is wrong because the severity is Medium, which is acceptable. Option B is wrong because the rule is enabled. Option D is wrong because the threshold and operator are defined.

Answer

The rule should be disabled until tuned.

Answer

The severity should be High.

Answer

The trigger threshold is too low.

Question 5

Refer to the exhibit. You are reviewing a Bicep template for deploying an Azure SQL Database server. Which security best practice is violated?

Accepted Answer

Administrator password is hardcoded in plain text.. Option D is correct because hardcoding passwords in code is a security risk. Option A is wrong because publicNetworkAccess is disabled. Option B is wrong because TLS version is set to 1.2. Option C is wrong because Azure SQL does not require Azure AD auth by default.

Answer

Minimal TLS version is set to 1.2, which is acceptable.

Answer

Public network access is disabled, which may affect connectivity.

Answer

Azure AD authentication is not configured.

Question 6

Which TWO actions should you take to protect Azure Virtual Machines from ransomware attacks? (Choose two.)

Accepted Answer

Enable Azure Backup for all VMs.. Options A and C are correct. Option A: Backups (Azure Backup) are essential for recovery. Option C: Antimalware (Microsoft Defender Antivirus) helps prevent infection. Option B is wrong because disabling public RDP reduces attack surface but is not specific to ransomware. Option D is wrong because Azure Firewall is for network segmentation, not direct ransomware protection. Option E is wrong because auto-shutdown does not prevent ransomware.

Answer

Configure Azure Firewall to block all outbound traffic.

Answer

Use auto-shutdown schedules for VMs.

Answer

Disable RDP access from the internet.

Question 7

Which THREE components are required to implement a secure hybrid network architecture using Azure VPN Gateway? (Choose three.)

Accepted Answer

A local network gateway resource in Azure.. Options A, B, and C are correct. A: Local network gateway represents on-premises VPN device. B: Virtual network gateway (VPN Gateway) is the Azure side. C: Connection object ties them together with shared key. Option D is wrong because ExpressRoute is a different connectivity method. Option E is wrong because Azure Firewall is not required for VPN.

Answer

An ExpressRoute circuit.

Answer

An Azure Firewall.

Question 8

Which TWO features of Microsoft Defender for Cloud help you identify and remediate misconfigurations in your Azure environment? (Choose two.)

Accepted Answer

Security recommendations.. Options B and D are correct. B: Security recommendations provide actionable steps to fix misconfigurations. D: Secure score measures overall security posture and guides prioritization. Option A is wrong because JIT is for VM access. Option C is wrong because FIM is for file integrity. Option E is wrong because adaptive application controls are for allowed apps.

Answer

File integrity monitoring (FIM).

Answer

Just-in-time (JIT) VM access.

Answer

Adaptive application controls.

Question 9

Your organization is planning to deploy a new web application on Azure VMs. The security team requires that all incoming traffic to the VMs be inspected by a network virtual appliance (NVA) before reaching the VMs. Which Azure networking solution should you use to route traffic through the NVA?

Accepted Answer

User Defined Routes (UDRs). Option B is correct because User Defined Routes (UDRs) allow you to override Azure's default routing to force traffic through an NVA. Option A is wrong because Azure Firewall is a managed firewall service, not a routing mechanism. Option C is wrong because Azure Load Balancer distributes traffic but does not enforce routing through an NVA. Option D is wrong because NSGs filter traffic but do not route it.

Answer

Azure Firewall

Answer

Azure Load Balancer

Answer

Network Security Groups (NSGs)

Question 10

A company uses Azure Arc to manage on-premises servers. The security team wants to enforce that all servers (on-premises and Azure) have Microsoft Defender for Endpoint installed and running. Which solution should you use to ensure compliance across hybrid environments?

Accepted Answer

Azure Policy with Guest Configuration. Option C is correct because Azure Policy with Guest Configuration can audit and enforce configurations on Azure Arc-enabled servers. Option A is wrong because Microsoft Intune manages mobile devices and PCs, not servers. Option B is wrong because Microsoft Defender for Cloud provides security recommendations but cannot enforce configuration compliance. Option D is wrong because Azure Update Manager focuses on patching, not endpoint protection enforcement.

Answer

Microsoft Intune

Answer

Azure Update Manager

Answer

Microsoft Defender for Cloud

Question 11

Your organization has a multi-region Azure deployment with ExpressRoute connections to on-premises. You need to design a solution that ensures all traffic between on-premises and Azure is inspected by a firewall for both inbound and outbound connections. The solution must minimize latency and avoid a single point of failure. What design should you recommend?

Accepted Answer

Deploy Azure Firewall in each region with forced tunneling enabled. Option D is correct because deploying Azure Firewall in each region in an active-active configuration with forced tunneling provides inspection for all traffic without a single point of failure. Option A is wrong because a single firewall is a single point of failure and adds latency for all traffic. Option B is wrong because NSGs do not inspect traffic, they filter based on rules. Option C is wrong because a third-party NVA in a single hub introduces a single point of failure and potential licensing complexity.

Answer

Deploy Azure Firewall in one central hub region and route all traffic through it

Answer

Use Network Security Groups (NSGs) on subnets to filter traffic

Answer

Deploy a third-party NVA in a hub-and-spoke topology with a single hub

Question 12

Refer to the exhibit. The NSG is applied to a subnet containing a web server. The web server is not receiving HTTP traffic. What is the most likely cause?

Accepted Answer

The sourceAddressPrefix 'Internet' does not include all source IPs. Option B is correct because the rule uses 'Internet' as sourceAddressPrefix, which is a service tag that does not include all public IPs. The actual source IPs may not be covered. Option A is wrong because priority 100 is high enough (lower number = higher priority). Option C is wrong because the rules are correct for inbound traffic. Option D is wrong because the DenyAllOther rule has a higher priority number (1000) than AllowHTTP (100), so it is evaluated after AllowHTTP.

Answer

The DenyAllOther rule has a lower priority than AllowHTTP

Answer

The rule direction is Inbound, but the traffic is outbound

Answer

The priority of the AllowHTTP rule is too low (100)

Question 13

A company is implementing a zero-trust network for their Azure environment. They want to ensure that only authenticated and authorized users can access specific VMs, regardless of network location. Which Azure service should they use?

Accepted Answer

Azure Bastion. Option A is correct because Azure Bastion provides secure, RDP/SSH access to VMs without public IPs, and integrates with Entra ID for authentication. Option B is wrong because site-to-site VPN requires network connectivity, not zero-trust. Option C is wrong because Just-in-Time (JIT) VM access reduces exposure but still requires a public IP. Option D is wrong because NSGs filter by IP, not user identity.

Answer

Just-in-Time (JIT) VM Access

Answer

Site-to-Site VPN

Answer

Network Security Groups (NSGs)

Question 14

Your organization uses Microsoft Sentinel to monitor security events. You need to design a solution that alerts when a user account is created and then used to log in from a different country within 1 hour. Which KQL query structure should you use?

Accepted Answer

Use a join operation on AccountName with a time window. Option C is correct because a join operation on AccountName and a time window can correlate account creation and login events. Option A is wrong because a simple filter cannot correlate two events. Option B is wrong because a union just combines tables, no correlation. Option D is wrong because a summarize with timechart shows aggregation, not specific account correlation.

Answer

Use a single table filter with where clause

Answer

Use summarize with timechart

Answer

Use union to combine events

Question 15

Refer to the exhibit. The NSG is applied to a subnet containing Azure SQL databases. You notice that traffic from the internet to the databases is not being denied. What is the most likely reason?

Accepted Answer

The destinationAddressPrefix should be '*' instead of 'VirtualNetwork'. Option C is correct because the destinationAddressPrefix is 'VirtualNetwork', but SQL databases are not in a virtual network by default; they are PaaS services with a public endpoint. Option A is wrong because priority 100 is high. Option B is wrong because the rule explicitly denies traffic. Option D is wrong because the direction is inbound.

Answer

The rule should be Allow to deny traffic

Answer

The priority of the Deny rule is too low (100)

Answer

The direction should be Outbound