SC-100 Design security solutions for infrastructure Practice Test 12 — 15 Questions

Question 1

You are designing a network security solution for a multi-tier application in Azure that must meet PCI DSS compliance. You need to restrict traffic between tiers to only necessary ports and protocols. You also need to log all denied traffic for auditing. What is the most efficient design?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy Azure Firewall in a hub virtual network. Use application rules to allow specific FQDNs between tiers. Enable diagnostic logs and send them to a Log Analytics workspace.. Azure Firewall provides application-layer (L7) filtering via application rules to allow only specific FQDNs between tiers, and its diagnostic logs can capture all denied traffic for auditing, meeting PCI DSS requirements efficiently. Option A is wrong because Application Gateway with WAF is designed for inbound web traffic protection, not inter-tier traffic filtering. Option B is wrong because NSGs provide only L3/L4 filtering and their flow logs log accepted traffic, not denied traffic; additional configuration is needed to log denied traffic. Option D is wrong because deploying a third-party NVA adds unnecessary complexity and cost compared to Azure Firewall, which is a native managed service.

Answer

Deploy Azure Application Gateway in front of each tier. Use WAF policies to filter traffic.

Answer

Use network security groups (NSGs) on each subnet to allow/deny traffic by IP and port. Enable NSG flow logs for auditing.

Answer

Deploy a third-party NVA (e.g., Palo Alto) in the hub. Configure inter-tier routing through the NVA.

Question 2

Refer to the exhibit. You are reviewing an Azure Policy definition. What does this policy do?

Accepted Answer

Denies creation of any virtual machine that is attached to a public IP address.. The policy denies creation of any virtual machine that has a network interface with a public IP address. The condition in the policy checks if the network interface has a public IP configuration, which is typically indicated by the presence of a public IP address resource ID. Option A is incorrect because the policy does not check for a specific subnet; it checks for a public IP. Option C is incorrect because the policy denies VMs with NICs (specifically those with public IP), not VMs without NICs. Option D is incorrect because the policy denies creation, not allows, and does not target a specific subnet.

Answer

Denies creation of any virtual machine that has a network interface attached to a specific subnet.

Answer

Denies creation of any virtual machine that does not have a network interface.

Answer

Allows creation of virtual machines only if they have a network interface attached to a specific subnet.

Question 3

Your company uses Microsoft Defender for Cloud to manage security across multiple subscriptions. You need to ensure that all subscriptions have at least one Defender plan enabled, and you want to enforce this centrally using Azure Policy. What is the best approach?

Accepted Answer

Create an Azure Policy that audits subscriptions without any Defender plans and then use a remediation task to enable the required plans.. Azure Policy can audit whether subscriptions have any Defender plans enabled, and then use a remediation task to enable the required plans, providing central enforcement. Option A is incorrect because the continuous export feature streams security alerts to a Log Analytics workspace, not for policy enforcement. Option B is incorrect because Azure Policy cannot deny subscription creation; subscription creation is managed at the tenant level. Option C is incorrect because Azure Blueprints are deprecated in favor of Azure Policy and deployment stacks, and Blueprints assign resource templates rather than directly enforcing plan enablement across subscriptions.

Answer

Use the Defender for Cloud continuous export feature to send compliance data to a Log Analytics workspace and create alerts.

Answer

Create an Azure Policy that denies creation of subscriptions that do not have Defender plans enabled.

Answer

Use Azure Blueprints to assign Defender plans to all subscriptions.

Question 4

Your organization is planning to use Azure Bastion for secure RDP/SSH access to Azure VMs. You need to ensure that Bastion can reach the VMs in a spoke virtual network that is connected to a hub via VNet peering. The hub has an Azure Firewall. What is the minimal configuration required?

Accepted Answer

Deploy Azure Bastion in the hub VNet. Ensure the spoke VNet is peered to the hub VNet.. Azure Bastion is deployed in the hub VNet, and VNet peering between hub and spoke allows Bastion to reach the VMs using private IPs without the need for public IPs on VMs or traversing Azure Firewall. Deploying Bastion in the hub enables centralized access to multiple peered spoke VNets. Option A is incorrect because VMs do not need public IPs when using Bastion. Option C is incorrect because placing Bastion in the spoke VNet would not provide the minimal configuration; the question asks for minimal and Bastion in the hub leverages existing peering. Option D is incorrect because no additional route is required; VNet peering automatically provides connectivity between the Bastion subnet in the hub and VM subnets in the spoke.

Answer

Assign a public IP address to each VM. Deploy Azure Bastion in the hub VNet.

Answer

Deploy Azure Bastion in the spoke VNet. Configure Azure Firewall to allow traffic from Bastion to the VMs.

Answer

Deploy Azure Bastion in the hub VNet. Ensure the spoke VNet has a route to the Bastion subnet.

Question 5

You are designing a secure access solution for an Azure Kubernetes Service (AKS) cluster that hosts a critical application. You need to ensure that only authorized users can access the Kubernetes API server. Which authentication method should you use?

Accepted Answer

Integrate AKS with Microsoft Entra ID for authentication.. Integrating AKS with Microsoft Entra ID provides robust authentication for the Kubernetes API server. Option A is wrong because service account tokens are intended for pod-to-API communication, not for user authentication. Option B is wrong because AKS managed identities are for pod authentication, not for user authentication. Option C is wrong because Azure RBAC for Kubernetes is authorization, not authentication.

Answer

Use Kubernetes service account tokens.

Answer

Use AKS managed identities for each user.

Answer

Use Azure RBAC for Kubernetes authorization.

Question 6

Your organization uses Microsoft Defender for Identity (MDI) to protect on-premises Active Directory. You need to integrate MDI with Microsoft Sentinel to centralize detection and response. What is the required configuration?

Accepted Answer

Enable the Microsoft Defender for Identity data connector in Microsoft Sentinel.. The Microsoft Defender for Identity data connector in Microsoft Sentinel enables ingestion of MDI alerts and events, integrating on-premises AD protection with cloud-based SIEM. Option A is incorrect because the MDI sensor is already deployed on-premises; deploying it on an Azure VM is unnecessary. Option B is incorrect because Microsoft Entra ID Protection focuses on cloud identities, not on-premises AD. Option D is incorrect because MDI does not natively forward alerts to Syslog; it uses its own connector in Sentinel.

Answer

Deploy the MDI sensor on an Azure VM to send data to Sentinel.

Answer

Integrate Microsoft Entra ID Protection with Sentinel instead.

Answer

Configure MDI to forward logs to a Syslog server, then use the Syslog connector in Sentinel.

Question 7

Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You are designing a solution to protect against password spray attacks. You need to implement a solution that can detect and block malicious authentication attempts in real-time. What should you use?

Accepted Answer

Microsoft Entra ID Protection with Conditional Access policies.. Entra ID Identity Protection provides real-time risk detection and conditional access policies to block risky sign-ins, including password spray. Option B is wrong because Microsoft Defender for Identity focuses on on-premises AD attacks, not cloud authentication. Option C is wrong because Azure AD MFA is a verification method, not a detection mechanism. Option D is wrong because password hash sync is for synchronization, not detection.

Answer

Microsoft Defender for Identity with a VPN integration.

Answer

Azure AD Multi-Factor Authentication (MFA) enforced for all users.

Answer

Password hash synchronization with Azure AD Connect.

Question 8

You are designing a secure CI/CD pipeline for Azure using GitHub Actions. You need to ensure that secrets (e.g., Azure service principal credentials) are stored securely and accessed only by authorized actions. What should you use?

Accepted Answer

Use GitHub Actions secrets to store the credentials.. GitHub Actions secrets are encrypted and provide a secure way to store sensitive information like Azure service principal credentials. They can be scoped to repositories, environments, or organization-level, ensuring only authorized workflows can access them. Option B is incorrect because managed identities cannot be directly used from GitHub Actions without an authentication mechanism like a service principal secret. Option C is incorrect because storing a secret in GitHub is still needed to access Key Vault, and using GitHub Secrets is the primary method. Option D is incorrect because environment variables in the repository are visible to anyone with repository access and are not encrypted.

Answer

Use Azure AD managed identities for GitHub Actions.

Answer

Store secrets in Azure Key Vault and access them using a service principal secret stored in GitHub.

Answer

Store secrets as environment variables in the GitHub repository.

Question 9

Your organization is designing a Microsoft Sentinel workspace for a multi-region deployment. You need to optimize cost while ensuring that security data is available for investigation in the primary region. Which TWO actions should you take?

Accepted Answer

Use a single Sentinel workspace in the primary region and ingest data from all regions via diagnostic settings.. The two actions that directly optimize cost for a multi-region Microsoft Sentinel deployment are consolidating logs into a single workspace in the primary region (Option A) and enabling the Azure Monitor Agent with data collection rules to filter logs (Option B).

Option A avoids duplicate ingestion and storage costs by centralizing all regional data into one workspace. 
Option B reduces the volume of data ingested, further lowering costs. 
Options C, D, and E either do not reduce costs or can increase them. Azure Lighthouse (Option C) only centralizes management and does not affect data volume or cost. Log Analytics clusters (Option D) require a high ingestion commitment and are not a universal cost-saving measure. Deploying separate workspaces in each region (Option E) duplicates data and costs.

Answer

Use Azure Lighthouse to manage multiple Sentinel workspaces from a single pane of glass.

Answer

Use Log Analytics clusters with dedicated clusters to reduce costs.

Answer

Deploy Sentinel workspaces in each region and use cross-workspace queries.

Question 10

You are designing a secure data exfiltration protection solution for Azure Storage accounts. You need to prevent data from being copied to unauthorized external locations. Which THREE controls should you implement?

Accepted Answer

Enable Microsoft Defender for Storage and configure alerts for anomalous data extraction.. Microsoft Defender for Storage can detect anomalous data extraction patterns, alerting on potential exfiltration. Option B is correct because Azure Firewall with application rules can restrict outbound traffic to only approved FQDNs, preventing data from being sent to unauthorized external locations. Option C is correct because NSGs can deny outbound internet traffic from subnets, blocking egress to the internet. Option D is wrong because Azure Private Endpoints restrict access to the storage account from the virtual network but do not prevent data from being exfiltrated once accessed (e.g., if an attacker has access, they can still copy data out). Option E is wrong because soft delete and versioning are data recovery features and do not prevent exfiltration.

Answer

Use Azure Private Endpoints for all storage accounts.

Answer

Enable soft delete and versioning for blobs.

Question 11

Your company is planning to use Microsoft Intune for mobile device management (MDM). You need to ensure that devices are compliant before accessing corporate resources. Which TWO components should you configure?

Accepted Answer

Conditional Access policies in Microsoft Entra ID.. Conditional Access policies in Microsoft Entra ID (option C) enforce access controls based on device compliance, while Compliance policies (option D) define the conditions for device compliance. Together, they ensure only compliant devices can access corporate resources. Option A (Device configuration policies) are for settings, not compliance. Option B (Enrollment restrictions) control which devices can enroll, not post-enrollment compliance. Option E (App protection policies) manage app-level data protection, not device compliance.

Answer

Device configuration policies.

Answer

Enrollment restrictions.

Answer

App protection policies.

Question 12

You are a security architect for a large financial services company. The company has a hybrid identity infrastructure with on-premises Active Directory and Microsoft Entra ID (Azure AD). They have recently suffered a password spray attack that compromised several accounts. Management wants to implement a Zero Trust security model and has mandated the following requirements: 1. All user authentication must be protected by phishing-resistant MFA. 2. Legacy authentication protocols must be blocked. 3. All sign-in risks must be detected and automatically remediated. The current environment includes: - Microsoft 365 E5 licenses for all users. - Microsoft Entra ID P2 licenses. - On-premises Active Directory with password hash sync. - Azure AD Application Proxy for publishing on-premises apps. - A third-party VPN solution for remote access. You need to design a solution that meets the requirements. What should you do?

Accepted Answer

Deploy Windows Hello for Business for all users. Configure Conditional Access policies to block legacy authentication and require MFA for all cloud apps. Use Entra ID Protection to detect risky sign-ins and automatically require password change or block access.. Windows Hello for Business is a phishing-resistant MFA method that meets the requirement to protect all user authentication. Conditional Access policies can be configured to block legacy authentication protocols and enforce MFA for all cloud apps. Entra ID Protection can detect risky sign-ins and automatically remediate them by requiring a password change or blocking access, fulfilling the requirement for automatic remediation. Option A is incorrect because Azure AD MFA with phone call is not phishing-resistant; phone calls can be intercepted or spoofed, and they do not provide phishing resistance. Option B is incorrect because the Microsoft Authenticator app using OATH TOTP codes is not phishing-resistant; users can be tricked into entering the code on a fake site, making it vulnerable to phishing and MFA fatigue attacks. Option C is incorrect because while FIDO2 security keys are phishing-resistant, deploying hardware tokens to all users is logistically challenging and costly; more importantly, Identity Protection configured to only send alerts does not meet the requirement for automatic remediation—alerts require human action, not automatic response.

Answer

Enable Azure AD MFA with phone call for all users. Use Conditional Access to block legacy authentication. Use Identity Protection to detect risks and require MFA again.

Answer

Enable Azure AD MFA with the Microsoft Authenticator app (OATH TOTP). Use Conditional Access to block legacy authentication and require MFA. Configure Identity Protection to alert on risky sign-ins.

Answer

Deploy FIDO2 security keys to all users. Configure Conditional Access to block legacy authentication. Use Identity Protection to detect risks and send alerts to the SOC.

Question 13

You are a security architect for a software development company. The company uses GitHub for source control and Azure DevOps for CI/CD. They have a large number of repositories and want to ensure that secrets (e.g., API keys, connection strings) are never committed to code. They also want to scan pull requests for secrets before merging. The company has Microsoft Defender for Cloud and Microsoft Purview available. You need to design a solution that prevents secret leaks. What should you use?

Accepted Answer

Enable GitHub secret scanning for all repositories. Configure push protection to block commits containing secrets. Use custom patterns to scan for company-specific secrets.. GitHub secret scanning can scan repositories for known secret patterns and supports custom patterns for company-specific secrets. Push protection blocks commits containing secrets before they are pushed. Option A is incorrect because Microsoft Defender for Cloud does not provide built-in secret scanning for GitHub repositories; GitHub secret scanning is a separate feature. Option B is incorrect because Azure Key Vault stores secrets but does not scan code for secrets. Option C is incorrect because Microsoft Purview Information Protection is for data classification and labeling, not for secret scanning in source code.

Answer

Enable Microsoft Defender for Cloud's 'Secrets scanning' feature for GitHub repositories.

Answer

Use Azure Key Vault to store secrets and enforce policies that require developers to use Key Vault references.

Answer

Use Microsoft Purview Information Protection to scan repositories and classify secrets.

Question 14

You are a security architect for a retail company that uses Microsoft 365 and Azure. The company has a large number of remote employees who use both company-managed and personal devices. You need to design a solution to ensure that only compliant devices can access corporate email (Exchange Online) and files (SharePoint Online). The company has Microsoft Intune and Microsoft Entra ID P1 licenses. You need to implement device-based conditional access. What should you do?

Accepted Answer

Enroll devices in Intune, create compliance policies, and configure Conditional Access policies in Entra ID to require compliant devices.. Intune compliance policies define device health requirements, and Conditional Access policies enforce access based on compliance. Option A is wrong because app protection policies are for mobile application management (MAM) without device enrollment, but the requirement is device-based. Option C is wrong because device enrollment itself does not enforce compliance. Option D is wrong because Configuration Manager is for on-premises management, not cloud devices.

Answer

Deploy app protection policies (MAM) in Intune to protect data in Exchange Online and SharePoint Online.

Answer

Require all devices to be enrolled in Intune using automatic enrollment via Group Policy.

Answer

Use Microsoft Endpoint Configuration Manager to manage device compliance and integrate with Entra ID.

Question 15

Your organization plans to use Microsoft Defender for Cloud to protect hybrid workloads across Azure and on-premises servers. You need to ensure that security policies are consistently applied and that compliance status is monitored centrally. What should you configure?

Accepted Answer

Create Azure Policy initiatives and assign them to management groups and subscriptions.. Azure Policy allows defining and enforcing security policies across Azure and hybrid environments via Arc-enabled servers. Option A is incorrect because Azure Security Benchmark is a set of guidelines, not a configuration mechanism. Option C is incorrect because Defender for Cloud's security policies are built on Azure Policy. Option D is incorrect because Azure Blueprints are deprecated in favor of deployment stacks.

Answer

Implement Azure Security Benchmark recommendations manually.

Answer

Configure security policies directly in Microsoft Defender for Cloud.

Answer

Deploy Azure Blueprints to assign policies to management groups.