SC-100 Design security solutions for infrastructure Practice Test 12 — 15 Questions

Question 1

Your company uses Azure DevOps to deploy infrastructure. You need to ensure that all deployed resources have specific tags for cost tracking. Which Azure policy effect should you use to prevent deployment of untagged resources?

Accepted Answer

Deny. Option B is correct because the 'Deny' effect prevents creation of non-compliant resources. Option A is wrong because 'Audit' only logs compliance, does not block. Option C is wrong because 'DeployIfNotExists' can add tags after creation but does not prevent deployment. Option D is wrong because 'Disabled' turns off the policy.

Answer

Disabled

Answer

DeployIfNotExists

Answer

Audit

Question 2

A global company with branches worldwide wants to secure access to Azure resources using a zero-trust approach. They require that all access requests be authenticated, authorized, and encrypted, and that the user's device must be compliant with corporate policies. Which combination of services should they use?

Accepted Answer

Azure AD Conditional Access and Azure AD Application Proxy. Option C is correct because Azure AD Conditional Access can enforce authentication and device compliance, while Azure AD Application Proxy provides secure remote access to on-premises apps without VPN. Option A is wrong because Azure VPN Gateway does not enforce device compliance. Option B is wrong because Azure Firewall does not enforce authentication. Option D is wrong because Azure AD B2C is for external identities, not internal access.

Answer

Azure VPN Gateway and Azure AD Multi-Factor Authentication

Answer

Azure Firewall and Azure AD Password Protection

Answer

Azure AD B2C and Azure AD Identity Protection

Question 3

Which TWO of the following are valid methods to secure Azure Kubernetes Service (AKS) workloads?

Accepted Answer

Integrate Azure AD for cluster authentication. Option A is correct because Azure AD integration enables authentication for AKS clusters. Option C is correct because Azure Policy with Gatekeeper can enforce security policies on AKS. Option B is wrong because Network Security Groups apply to VMs, not AKS pods. Option D is wrong because Azure Firewall is for network-level filtering, not workload security. Option E is wrong because Azure Front Door is for global load balancing, not AKS workload security.

Answer

Apply Network Security Groups to pod subnets

Answer

Deploy Azure Firewall in front of the AKS cluster

Answer

Use Azure Front Door to protect API endpoints

Question 4

Which THREE of the following are best practices for designing a secure hybrid network architecture with Azure?

Accepted Answer

Use Azure Bastion for secure VM access without public IPs. Option A is correct because using ExpressRoute with Azure Firewall provides secure, dedicated connectivity and inspection. Option B is correct because forcing tunneling ensures all internet-bound traffic goes through the firewall for inspection. Option C is correct because Azure Bastion eliminates the need for public IPs on VMs. Option D is wrong because opening all ports to a management subnet violates least privilege. Option E is wrong because a single VPN gateway is a single point of failure.

Answer

Open all ports to a management subnet for ease of administration

Answer

Use a single VPN gateway for all regions

Question 5

Which TWO of the following are features of Azure DDoS Protection?

Accepted Answer

Cost protection for scaled resources during an attack. Option B is correct because DDoS Protection provides adaptive tuning and mitigation. Option D is correct because it offers cost protection for scaled resources during an attack. Option A is wrong because DDoS Protection does not provide a web application firewall (WAF is separate). Option C is wrong because DDoS Protection does not provide SSL termination. Option E is wrong because DDoS Protection is not a VPN service.

Answer

Web application firewall (WAF) capabilities

Answer

Site-to-site VPN connectivity

Answer

SSL termination and offloading

Question 6

Refer to the exhibit. A company applies this Azure Policy to their subscription. An administrator tries to create a VM with a public IP address. What will happen?

Accepted Answer

The VM creation will be denied. Option A is correct because the policy denies creation of network interfaces with a public IP. Option B is wrong because the policy does not audit, it denies. Option C is wrong because the policy applies to all resources. Option D is wrong because the policy does not create a public IP.

Answer

The public IP will be automatically removed

Answer

The VM will be created, but an alert will be generated

Answer

The policy will only apply to VMs in a specific resource group

Question 7

Your organization uses Azure SQL Database with Azure AD authentication. You need to ensure that database administrators (DBAs) can only perform management tasks from a specific Azure region and only during business hours. Which solution should you use?

Accepted Answer

Azure AD Conditional Access policies. Option A is correct because Conditional Access can enforce location and time restrictions for Azure AD authenticated users. Option B is wrong because Azure SQL Firewall rules filter by IP, not user identity. Option C is wrong because Azure Policy cannot enforce time-based access. Option D is wrong because Azure RBAC cannot enforce location or time.

Answer

Azure RBAC with custom roles

Answer

Azure Policy with custom policy

Answer

Azure SQL Database firewall rules

Question 8

Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to ensure that user passwords are synchronized securely and that password changes on-premises are reflected in the cloud quickly. Which tool should you configure?

Accepted Answer

Microsoft Entra Connect. Option B is correct because Azure AD Connect synchronizes identities and passwords with hash synchronization. Option A is wrong because Microsoft Entra Connect is the same as Azure AD Connect. Option C is wrong because AD FS is for federation, not password synchronization. Option D is wrong because Microsoft Identity Manager is for identity governance, not synchronization.

Answer

Azure AD Connect

Answer

Active Directory Federation Services (AD FS)

Answer

Microsoft Identity Manager

Question 9

Your organization is deploying Microsoft Defender for Cloud to secure a hybrid environment with workloads in Azure and on-premises. You need to ensure that all servers are covered by Defender for Cloud's plans. Which two actions should you take?

Accepted Answer

Install the Azure Connected Machine agent (Azure Arc) on on-premises servers.. Option A is correct because enabling the appropriate Defender plans (e.g., Servers) on the Azure subscription covers Azure VMs. Option C is correct because deploying the Azure Arc agent on on-premises servers allows them to be managed by Defender for Cloud. Option B is wrong because enabling just the foundational CSPM doesn't include the server-specific protections. Option D is wrong because Defender for Cloud doesn't require Azure Monitor agents for basic coverage, though it's recommended for advanced features.

Answer

Enable only the foundational cloud security posture management (CSPM) on the subscription.

Answer

Deploy the Azure Monitor Agent to all on-premises servers.

Question 10

You are designing a network security solution for a multi-tier application in Azure that must meet PCI DSS compliance. You need to restrict traffic between tiers to only necessary ports and protocols. You also need to log all denied traffic for auditing. What is the most efficient design?

Accepted Answer

Deploy Azure Firewall in a hub virtual network. Use application rules to allow specific FQDNs between tiers. Enable diagnostic logs and send them to a Log Analytics workspace.. Option A is correct because Azure Firewall with application rules provides L7 filtering, and diagnostic logs capture denied traffic. Option B is wrong because NSGs lack L7 filtering and logging of denied traffic is not as comprehensive. Option C is wrong because Application Gateway is a load balancer, not a firewall for inter-tier traffic. Option D is wrong because NVAs add complexity and cost without clear benefit over Azure Firewall for this use case.

Answer

Deploy Azure Application Gateway in front of each tier. Use WAF policies to filter traffic.

Answer

Use network security groups (NSGs) on each subnet to allow/deny traffic by IP and port. Enable NSG flow logs for auditing.

Answer

Deploy a third-party NVA (e.g., Palo Alto) in the hub. Configure inter-tier routing through the NVA.

Question 11

Refer to the exhibit. You are reviewing an Azure Policy definition. What does this policy do?

Accepted Answer

Denies creation of any virtual machine that is attached to a public IP address.. Option A is correct because the policy denies creation of virtual machines that have any network interface (NIC) attached to a public IP (by checking the NIC's id field, which would be present if attached). Option B is wrong because the policy does not target VMs without a NIC. Option C is wrong because the policy denies VMs with NICs, not VMs without NICs. Option D is wrong because the policy does not check for a specific subnet.

Answer

Denies creation of any virtual machine that has a network interface attached to a specific subnet.

Answer

Denies creation of any virtual machine that does not have a network interface.

Answer

Allows creation of virtual machines only if they have a network interface attached to a specific subnet.

Question 12

Your company uses Microsoft Defender for Cloud to manage security across multiple subscriptions. You need to ensure that all subscriptions have at least one Defender plan enabled, and you want to enforce this centrally using Azure Policy. What is the best approach?

Accepted Answer

Create an Azure Policy that audits subscriptions without any Defender plans and then use a remediation task to enable the required plans.. Option C is correct because Azure Policy can audit if a subscription has no Defender plans enabled, and then use a remediation task to enable the plans. Option A is wrong because Azure Policy cannot directly enable plans without a remediation task. Option B is wrong because Defender for Cloud's continuous export is for security alerts, not policy enforcement. Option D is wrong because Azure Blueprints are being deprecated in favor of Azure Policy and deployment stacks.

Answer

Use the Defender for Cloud continuous export feature to send compliance data to a Log Analytics workspace and create alerts.

Answer

Create an Azure Policy that denies creation of subscriptions that do not have Defender plans enabled.

Answer

Use Azure Blueprints to assign Defender plans to all subscriptions.

Question 13

Your organization is planning to use Azure Bastion for secure RDP/SSH access to Azure VMs. You need to ensure that Bastion can reach the VMs in a spoke virtual network that is connected to a hub via VNet peering. The hub has an Azure Firewall. What is the minimal configuration required?

Accepted Answer

Deploy Azure Bastion in the hub VNet. Ensure the spoke VNet is peered to the hub VNet.. Option D is correct because Azure Bastion does not require public IPs on VMs nor does it need to traverse the firewall; it uses private IPs and the Bastion host in the same or peered VNet. Option A is wrong because VMs do not need public IPs with Bastion. Option B is wrong because Bastion does not need to go through the firewall; it uses direct private IP connectivity. Option C is wrong because Bastion does not need a public IP on the VM.

Answer

Assign a public IP address to each VM. Deploy Azure Bastion in the hub VNet.

Answer

Deploy Azure Bastion in the spoke VNet. Configure Azure Firewall to allow traffic from Bastion to the VMs.

Answer

Deploy Azure Bastion in the hub VNet. Ensure the spoke VNet has a route to the Bastion subnet.

Question 14

You are designing a secure access solution for an Azure Kubernetes Service (AKS) cluster that hosts a critical application. You need to ensure that only authorized users can access the Kubernetes API server. Which authentication method should you use?

Accepted Answer

Integrate AKS with Microsoft Entra ID for authentication.. Option B is correct because Microsoft Entra ID integration provides robust authentication and authorization for the AKS API server. Option A is wrong because local accounts (service principal or client certificate) are less secure and do not integrate with identity management. Option C is wrong because Azure RBAC for Kubernetes is authorization, not authentication. Option D is wrong because managed identities are for pod authentication, not for users.

Answer

Use Kubernetes service account tokens.

Answer

Use AKS managed identities for each user.

Answer

Use Azure RBAC for Kubernetes authorization.

Question 15

Your organization uses Microsoft Defender for Identity (MDI) to protect on-premises Active Directory. You need to integrate MDI with Microsoft Sentinel to centralize detection and response. What is the required configuration?

Accepted Answer

Enable the Microsoft Defender for Identity data connector in Microsoft Sentinel.. Option A is correct because the MDI data connector in Sentinel enables ingestion of MDI alerts. Option B is wrong because MDI does not use Syslog for its native alerts; it uses a specific connector. Option C is wrong because Azure AD Identity Protection is for cloud identities, not on-premises AD. Option D is wrong because the MDI sensor is already deployed on-premises; no need to deploy it in Azure.

Answer

Deploy the MDI sensor on an Azure VM to send data to Sentinel.

Answer

Integrate Microsoft Entra ID Protection with Sentinel instead.

Answer

Configure MDI to forward logs to a Syslog server, then use the Syslog connector in Sentinel.