SC-100 Design security solutions for infrastructure Practice Test 11 — 15 Questions

Question 1

Which TWO Microsoft Purview solutions should you use to protect sensitive data in Microsoft 365? (Choose two.)

Accepted Answer

Sensitivity labels and policies.. Sensitivity labels and policies (C) are correct because they apply persistent protection to content by classifying data and enforcing encryption, content marking, and usage restrictions that travel with the file or email across Microsoft 365 workloads. Data Loss Prevention (DLP) policies (E) are correct because they detect sensitive information types and take protective actions such as blocking, warning, or encrypting data when it is shared inappropriately in Exchange Online, SharePoint, OneDrive, and Teams. Audit (A) is not a protection solution; it records and searches user and admin activity for investigation and compliance reporting. Insider Risk Management (B) focuses on detecting and remediating risky user behavior rather than directly protecting sensitive data. eDiscovery (D) is used to identify, preserve, collect, and review content for legal or investigative purposes, not to enforce data protection.

Answer

Microsoft Purview Audit.

Answer

Insider Risk Management.

Answer

Microsoft Purview eDiscovery.

Question 2

Refer to the exhibit. You are deploying an ARM template for a Windows VM. The adminPassword parameter references a secret in Key Vault. However, the deployment fails with an access denied error. What is the most likely cause?

Accepted Answer

The deployment principal lacks 'Get' and 'List' permissions on the Key Vault secret.. When referencing a Key Vault secret in an ARM template parameter, the user or service principal deploying the template must have 'Get' and 'List' permissions on the secret. If the deployment principal does not have those permissions, access is denied. Option A is wrong because special characters in secrets are supported, but the deployment still requires permissions. Option B is wrong because the template uses a parameter reference to the secret, not the secret's URI directly; that is the correct approach. Option D is wrong because the Key Vault can be in a different resource group than the deployment, as long as the deployment principal has the necessary permissions.

Answer

The secret value contains special characters that need to be escaped.

Answer

The template should use the secret's URI directly instead of a parameter reference.

Answer

The Key Vault is in a different resource group than the deployment.

Question 3

Your company is deploying Microsoft Sentinel to centralize security logs from Azure, on-premises, and other clouds. You need to ensure logs are ingested cost-effectively while maintaining search performance for the last 30 days. What should you configure?

Accepted Answer

Use Log Analytics workspace with 30-day interactive retention and set long-term retention for older data.. Microsoft Sentinel stores ingested data in a Log Analytics workspace, where the interactive retention setting controls how long data remains available for fast KQL queries and analytics rules. Setting 30-day interactive retention satisfies the search-performance requirement for the last 30 days, while configuring long-term retention for older data keeps historical logs at a lower cost. The other options do not fit: Azure Blob Storage with Azure Data Explorer (A) is not Sentinel's native ingestion and query path, Sentinel has no 30-day free tier that then converts to paid (C), and Event Hubs (D) is only an ingestion pipeline, not a retention or query configuration.

Answer

Store logs in Azure Blob Storage and use Azure Data Explorer for queries.

Answer

Use Sentinel's free tier for 30 days and then move to paid tier.

Answer

Ingest logs into Azure Event Hubs and then into Sentinel.

Question 4

Your organization is deploying a new web application in Azure and needs to secure it against common web attacks like SQL injection and cross-site scripting. You need to configure a solution that provides centralized protection at the network edge. Which Azure service should you use?

Accepted Answer

Azure Web Application Firewall (WAF) on Azure Application Gateway. Azure Web Application Firewall (WAF) on Azure Application Gateway is correct because it provides centralized, edge-level protection specifically against Layer 7 web attacks such as SQL injection and cross-site scripting (XSS) using OWASP rule sets. It inspects HTTP/HTTPS traffic at the application layer and can be attached to Application Gateway to filter malicious requests before they reach the web application. NSGs operate at Layers 3/4 and only filter traffic by IP, port, and protocol, so they cannot detect SQL injection or XSS payloads. Azure DDoS Protection mitigates volumetric and protocol-level denial-of-service attacks, not application-layer injection or scripting attacks. Azure Firewall is a stateful Layer 3-7 network firewall with FQDN and threat-intelligence filtering, but it does not provide the dedicated OWASP-based web attack inspection that WAF does.

Answer

Network Security Groups (NSGs)

Answer

Azure DDoS Protection

Answer

Azure Firewall

Question 5

Your company uses Azure Virtual Machines (VMs) running Windows Server. You need to ensure that only approved applications can run on the VMs. Which Azure security feature should you use?

Accepted Answer

Azure Policy with application control. Azure Policy with application control is correct because it lets you enforce that only approved applications run on your Windows Server VMs by using the Guest Configuration extension to audit or deploy Windows Defender Application Control (WDAC) / AppLocker policies at scale. This directly addresses the requirement to restrict execution to approved applications. Azure Firewall (A) filters network traffic, not which applications execute on the VM. Microsoft Defender for Cloud (C) provides security posture and threat protection but does not itself enforce an application allowlist. Just-in-Time VM access (D) restricts inbound management ports, not application execution.

Answer

Azure Firewall

Answer

Microsoft Defender for Cloud

Answer

Just-in-Time VM access

Question 6

You are designing a security solution for containers running on Azure Kubernetes Service (AKS). The requirements include: scanning container images for vulnerabilities, enforcing runtime security, and generating alerts for suspicious activities. Which combination of services should you use?

Accepted Answer

Microsoft Defender for Cloud with Defender for Containers plan. Microsoft Defender for Cloud with the Defender for Containers plan (option D) is correct because it is the purpose-built Azure solution that provides image vulnerability scanning (via the integrated Qualys/registry scanner), runtime threat detection using the Defender sensor on AKS nodes, and security alerts for suspicious container activity in a single integrated service. It also supports Kubernetes-native hardening recommendations and integrates with AKS and Azure Container Registry out of the box. Option A is incomplete because Azure Security Center is the former name of Defender for Cloud and Azure Policy alone only enforces governance, not runtime detection or image scanning. Option B does not fit because Azure Container Registry only stores images and Azure Monitor provides telemetry, not vulnerability scanning or container threat alerts. Option C is incorrect because Azure Policy and Azure Firewall address compliance and network filtering, not image scanning or runtime container security.

Answer

Azure Security Center and Azure Policy

Answer

Azure Container Registry and Azure Monitor

Answer

Azure Policy and Azure Firewall

Question 7

Your organization has a Microsoft 365 E5 subscription and uses Microsoft Entra ID for identity. You need to implement a solution to secure privileged access to Azure resources, requiring just-in-time access and approval workflows. What should you configure?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM). Microsoft Entra Privileged Identity Management (PIM) is the correct choice because it provides just-in-time privileged role activation, time-bound assignments, and approval workflows for Azure resources and Entra ID roles, which directly matches the requirement. PIM also supports access reviews, MFA enforcement on activation, and audit trails for privileged access. Microsoft Defender for Identity is a threat detection service for identity-based attacks, not a JIT access or approval mechanism. Microsoft Entra ID administrative units are used to scope administrative permissions to subsets of users or groups, not to provide just-in-time activation or approvals. Microsoft Entra Conditional Access enforces access policies based on conditions such as user, device, and location, but it does not provide JIT role activation or approval workflows.

Answer

Microsoft Defender for Identity

Answer

Azure AD administrative units

Answer

Microsoft Entra Conditional Access

Question 8

You are designing a security solution for Azure SQL Database. The requirements include: encrypting data at rest and in transit, and masking sensitive data from non-privileged users. Which two features should you implement? (Choose two.)

Accepted Answer

Dynamic Data Masking. Transparent Data Encryption (TDE) [CORRECT] is the right choice for encrypting data at rest, as it performs real-time encryption and decryption of the database, associated backups, and transaction log files at the page level using a symmetric key protected by a certificate stored in Azure Key Vault or the service-managed keystore. Dynamic Data Masking [CORRECT] is the right choice for masking sensitive data from non-privileged users, since it limits data exposure by obfuscating the results of queries on designated columns (for example, showing XXXX for a credit card number) without altering the underlying data, and privileged users can be excluded via UNMASK permission. Encryption in transit is handled automatically by Azure SQL Database through TLS, so no additional feature is needed for that requirement. Azure Firewall (B) is a network security service for filtering traffic to Azure resources and does not provide data-at-rest encryption or data masking. Column-level encryption (D) and Always Encrypted (E) both encrypt specific column data, but they address data-at-rest confidentiality for privileged applications rather than masking data from non-privileged users, and Always Encrypted additionally requires client-side key management, making them less appropriate for the stated masking requirement.

Answer

Azure Firewall

Answer

Column-level encryption

Answer

Always Encrypted

Question 9

You are designing a security solution for Azure API Management. The requirements include: protecting APIs from abuse, throttling requests, and validating JSON payloads. Which combination of features should you use?

Accepted Answer

Rate limiting policies, validate-json policy, and OAuth 2.0. API Management natively provides rate limiting and quota policies to throttle requests and protect against abuse, the validate-json policy to validate JSON payloads against a schema, and OAuth 2.0 support to secure API access via authorization servers. These features directly satisfy the stated requirements within the APIM gateway itself. Option A addresses identity and authentication but does not provide throttling or JSON schema validation. Option B offloads protection to Application Gateway WAF, which handles web attack patterns but not APIM-level rate limiting or JSON payload schema validation. Option D provides network-layer filtering with Azure Firewall and NSGs, which cannot inspect JSON payloads or apply API-level throttling.

Answer

Managed Identities and Azure AD authentication

Answer

Azure Web Application Firewall (WAF) on Application Gateway

Answer

Azure Firewall and Network Security Groups

Question 10

You need to design a solution to protect Azure VMs from malware and provide security recommendations. Which Azure service should you enable?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (option D) is the correct choice because it provides cloud workload protection, including Microsoft Defender for Servers, which delivers antimalware/endpoint protection and security recommendations for Azure VMs. It continuously assesses VM configurations and surfaces hardening recommendations, satisfying both the malware protection and security-recommendation requirements. Azure Sentinel (A) is a SIEM/SOAR platform for collecting and analyzing security events, not for directly protecting VMs from malware. Microsoft Intune (B) is for mobile device and endpoint management, primarily for user devices, not Azure VM workload protection. Azure Monitor (C) collects metrics and logs for observability but does not provide malware protection or security recommendations.

Answer

Azure Sentinel

Answer

Microsoft Intune

Answer

Azure Monitor

Question 11

Refer to the exhibit. You are reviewing an Azure Policy definition. What is the effect of this policy?

Accepted Answer

Denies creation of Windows VMs without automatic updates enabled. The correct answer is D: the policy denies creation of Windows VMs without automatic updates enabled. In Azure Policy, a Deny effect blocks the deployment request when the resource does not satisfy the condition, so a Windows VM whose automatic updates setting is not enabled would fail the policy evaluation and be rejected. This matches the scenario of enforcing automatic updates on Windows VMs at creation time. Option A is incorrect because it reverses the condition, denying VMs that already have automatic updates enabled. Option B is incorrect because it describes an Audit effect, not Deny, and audits VMs with updates disabled rather than blocking noncompliant deployments. Option C is incorrect because it targets Linux VMs and uses Audit, neither of which matches the policy's Windows VM Deny behavior.

Answer

Denies creation of Windows VMs that have automatic updates enabled

Answer

Audits Windows VMs that have automatic updates disabled

Answer

Audits Linux VMs that have automatic updates enabled

Question 12

An organization uses Microsoft Sentinel to monitor their hybrid infrastructure. They need to detect brute-force attacks against their on-premises Windows servers. Which data source should they connect to Sentinel?

Accepted Answer

Windows Security Events via Azure Monitor Agent. Windows Security Events from Event ID 4625 (failed logon) are the primary source for detecting brute-force attacks. Azure Activity Log is for resource management events. DNS events are for DNS queries. Sysmon is for process activity, not logon failures.

Answer

Azure Activity Log

Answer

DNS Events

Answer

Sysmon Events

Question 13

A small business uses Microsoft 365 Business Premium and wants to secure their Windows 10 devices with Microsoft Intune. They need to ensure that only devices compliant with the company's security policies can access corporate email. What should they configure?

Accepted Answer

Conditional Access policy requiring compliant device. Conditional Access in Microsoft Entra ID can require device compliance before granting access to Exchange Online. Device compliance policies in Intune define the security requirements. Microsoft Entra application proxy is for on-prem apps. Microsoft Defender for Cloud Apps is for cloud app security. Windows Defender Firewall is for network security.

Answer

Azure AD Application Proxy

Answer

Windows Defender Firewall rules

Answer

Microsoft Defender for Cloud Apps session policy

Question 14

A company uses Azure Front Door to publish a web application globally. They need to protect against DDoS attacks and web application attacks (SQL injection, XSS). Which two services should they enable in combination?

Accepted Answer

Azure DDoS Protection Standard and Azure WAF policy on Front Door. Azure DDoS Protection protects against volumetric DDoS attacks. Azure Web Application Firewall (WAF) in Front Door protects against application-layer attacks. Azure Firewall is for network-layer filtering. Network Security Groups (NSGs) are for subnet-level filtering. Azure DDoS Protection Standard is the correct tier.

Answer

Azure DDoS Protection Standard and Azure Firewall

Answer

Azure WAF on Application Gateway and Network Security Groups

Answer

Azure Firewall and Azure DDoS Protection Basic

Question 15

A financial services company is designing a secure infrastructure for their Azure SQL Database. They need to encrypt data at rest using customer-managed keys (CMK) stored in a key vault with soft-delete and purge protection enabled. The encryption must be transparent to applications. What should they configure?

Accepted Answer

Transparent Data Encryption (TDE) with Azure Key Vault. Azure SQL Database supports Transparent Data Encryption (TDE) with CMK in Azure Key Vault. Always Encrypted is for column-level encryption. Dynamic Data Masking is for masking, not encryption. Azure Information Protection is for classification.

Answer

Azure Information Protection

Answer

Dynamic Data Masking

Answer

Always Encrypted