SC-100 Design security solutions for infrastructure Practice Test 12 — 15 Questions

Question 1

A company uses Microsoft Defender for Cloud to assess the security posture of their Azure subscriptions. They want to receive alerts when a resource is deployed without encryption enabled. What should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Policy definition to audit or deny resources without encryption. Azure Policy with a custom policy definition can audit or deny resources without encryption. Defender for Cloud's regulatory compliance dashboard shows compliance status. Security alerts are for threats, not configuration drift. Azure Blueprints are for packaging resources.

Answer

Azure Blueprints

Answer

Microsoft Defender for Cloud regulatory compliance dashboard

Answer

Microsoft Defender for Cloud security alerts

Question 2

Refer to the exhibit. A security analyst runs the following KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

Detect brute-force attacks against Windows servers. The query filters Windows Security Events for failed logon attempts (EventID 4625) in the last hour, groups by user account, computer, and IP address, and then shows only those with more than 10 failures. This is used to detect brute-force attacks.

Answer

List all accounts that have been locked out

Answer

Identify successful logins from multiple IP addresses

Answer

Find users who logged in after hours

Question 3

Your organization uses Microsoft Defender for Cloud to secure a hybrid environment. You need to ensure that virtual machines running on-premises are assessed for security misconfigurations. What should you deploy?

Accepted Answer

Azure Arc on the on-premises servers. Azure Arc on the on-premises servers (option C) is correct because Azure Arc projects non-Azure machines into Azure as connected machine resources, which is the prerequisite for Defender for Cloud to assess on-premises VMs for security misconfigurations via the Azure Monitor Agent and its recommendations. Without Arc-enabling the servers, Defender for Cloud cannot treat them as supported compute resources for misconfiguration assessment. Option A (Log Analytics agent) only collects log/telemetry data and does not by itself enable Defender for Cloud's security posture assessment of on-premises machines. Option B (Vulnerability Assessment solution) addresses CVE scanning rather than general security misconfiguration assessment, and it also depends on the machine already being onboarded. Option D (Azure Policy guest configuration) audits settings inside Azure VMs and Arc-enabled machines but is not the deployment that enables Defender for Cloud assessment of on-premises servers.

Answer

Log Analytics agent on the on-premises servers

Answer

Microsoft Defender for Cloud's Vulnerability Assessment solution

Answer

Azure Policy guest configuration

Question 4

Your company plans to use Microsoft Sentinel to manage security incidents. You need to design a solution that reduces alert fatigue by grouping related alerts into incidents. Which feature should you enable?

Accepted Answer

Analytics rule with alert grouping enabled. The correct option is A, an analytics rule with alert grouping enabled, because in Microsoft Sentinel analytics rules can be configured with incident grouping so that related alerts are consolidated into a single incident, directly reducing alert fatigue. Grouping settings let you combine alerts that share entities or occur within a defined timeframe, which is exactly the scenario's requirement. Watchlists (B) are for storing reference data used in queries and detections, not for grouping alerts into incidents. Automation rules (C) and playbooks (D) respond to or orchestrate actions on alerts/incidents but do not themselves group related alerts into incidents.

Answer

Watchlists to filter noisy alerts

Answer

Automation rules that trigger on alert creation

Answer

Playbooks that run on alert creation

Question 5

Your organization has a Microsoft Defender for Cloud Apps policy that detects suspicious OAuth app permissions. You need to ensure that when a high-risk app is detected, the app is automatically disabled and the user is notified. What is the most efficient design?

Accepted Answer

Use the 'Disable app' governance action in the policy, and configure email notification. Microsoft Defender for Cloud Apps policies natively support governance actions such as 'Disable app,' which can be applied automatically when a policy match occurs, and the same policy can be configured to send email notifications to affected users, making this the most efficient single-policy design. Option B only notifies the user and does not disable the high-risk app, so it fails the requirement. Option C adds unnecessary complexity by routing the alert to Microsoft Sentinel and building a playbook, which is not the most efficient approach when the native governance action exists. Option D relies on an external Power Automate flow triggered by the alert, which is also less efficient than using the built-in 'Disable app' governance action.

Answer

Configure the policy to notify the user via email

Answer

Send the alert to Microsoft Sentinel and create an incident with a playbook

Answer

Create a Power Automate flow that triggers on the alert to disable the app

Question 6

You are designing a secure remote access solution for on-premises web applications using Microsoft Entra ID. The solution must support multifactor authentication (MFA) and conditional access. Which service should you use?

Accepted Answer

Microsoft Entra application proxy. Microsoft Entra application proxy (option A) is correct because it is the service designed to publish on-premises web applications for secure remote access through Microsoft Entra ID, and it natively supports Entra ID authentication, multifactor authentication (MFA), and conditional access policies. It works via a lightweight connector on the on-premises network, so users authenticate to Entra ID before reaching the internal web app, satisfying the MFA and conditional access requirements. Windows Server DirectAccess (B) provides seamless intranet connectivity for domain-joined Windows clients but does not integrate with Entra ID conditional access for publishing web apps. A VPN gateway with RADIUS authentication (C) provides network-level access and can use MFA via RADIUS, but it does not natively enforce Entra ID conditional access for individual web applications. Microsoft Entra ID (D) is the identity provider itself, not the remote-access publishing service, so it alone cannot expose on-premises web applications.

Answer

Windows Server DirectAccess

Answer

VPN gateway with RADIUS authentication

Answer

Microsoft Entra ID (Azure AD)

Question 7

Your company plans to use Microsoft Sentinel to detect threats across multiple Azure subscriptions. You need to design a cost-effective solution that ingests logs from all subscriptions. What should you use?

Accepted Answer

Deploy a single Sentinel workspace and configure data collection rules to collect logs from all subscriptions. Microsoft Sentinel is built on a Log Analytics workspace, and a single workspace can ingest data from multiple Azure subscriptions via data collection rules (DCRs) and diagnostic settings, avoiding duplicated workspace and Sentinel costs. This centralized design is the most cost-effective since Sentinel pricing (ingestion and retention) applies per workspace, so consolidating into one workspace prevents paying for multiple Sentinel instances. Azure Lighthouse (A) is for delegated resource management across tenants, not for log ingestion into Sentinel. Creating a separate workspace per subscription (C) multiplies Sentinel and Log Analytics costs and fragments detection. Azure Policy (D) can assign a workspace via DeployIfNotExists, but assigning a workspace per subscription still results in multiple workspaces rather than the single cost-effective workspace the scenario requires.

Answer

Use Azure Lighthouse to manage cross-subscription connectivity

Answer

Create a separate Sentinel workspace for each subscription

Answer

Use Azure Policy to assign a Log Analytics workspace to each subscription

Question 8

Which TWO of the following are features of Microsoft Defender for Cloud that help secure infrastructure? (Choose two.)

Accepted Answer

Secure Score. Secure Score (A) is a core Microsoft Defender for Cloud capability that continuously assesses your Azure resources and subscriptions against security recommendations and benchmarks, aggregating the results into a numeric score so you can prioritize hardening actions for your infrastructure. Just-in-time (JIT) VM access (C) is also a Defender for Cloud feature that reduces the attack surface of virtual machines by blocking inbound management ports (RDP 3389, SSH 22) by default and opening them only for approved, time-limited requests from authorized IPs. Both directly serve Defender for Cloud's mission of strengthening and monitoring infrastructure security posture. Incident investigation (B) and User and Entity Behavior Analytics (E) are capabilities of Microsoft Sentinel (the SIEM/SOAR solution), not Defender for Cloud. Privileged Identity Management (D) is a separate Microsoft Entra ID (Azure AD) service for just-in-time privileged role activation and access reviews, not a Defender for Cloud infrastructure feature.

Answer

Incident investigation

Answer

Privileged Identity Management

Answer

User and Entity Behavior Analytics (UEBA)

Question 9

Which THREE of the following are best practices for securing Azure Kubernetes Service (AKS) clusters? (Choose three.)

Accepted Answer

Enable Azure Policy for AKS to enforce pod security. Option A is correct because Azure Policy for AKS (via the Azure Policy add-on for Kubernetes) enforces pod security standards and organizational guardrails at admission time, preventing non-compliant workloads from being deployed. Option B is correct because managed identities (including workload identity / Microsoft Entra ID pod identity) let pods authenticate to Azure resources without embedding credentials in code or config, eliminating secret sprawl and credential leakage. Option D is correct because Kubernetes NetworkPolicies enforce pod-level segmentation, restricting east-west traffic so a compromised pod cannot freely reach other workloads. Option C is wrong because ConfigMaps store data in plaintext and are not designed for sensitive values; secrets should go in Kubernetes Secrets backed by Azure Key Vault (or the Secrets Store CSI driver). Option E is wrong because disabling Kubernetes RBAC removes least-privilege access control and weakens, rather than strengthens, cluster security.

Answer

Store secrets in ConfigMaps

Answer

Disable Kubernetes RBAC to simplify management

Question 10

Your organization uses Microsoft Defender for Office 365. You need to design a solution to protect users from malicious links in email. What should you configure?

Accepted Answer

Safe Links policy. Safe Links policy (option C) is correct because it is the Defender for Office 365 feature that rewrites and time-of-click verifies URLs in email (and Teams/Office apps), blocking malicious links at delivery and after delivery. This directly addresses the requirement to protect users from malicious links in email. Anti-spam policy (A) filters spam and bulk mail but does not detonate or rewrite URLs for malicious link protection. Safe Attachments policy (B) detonates attachments in a sandbox, not links. Anti-phishing policy (D) covers impersonation and spoofing protections, not URL rewriting/blocking of malicious links.

Answer

Anti-spam policy

Answer

Safe Attachments policy

Answer

Anti-phishing policy

Question 11

Your company plans to deploy Microsoft Defender for Cloud to secure a multi-cloud environment that includes Azure, AWS, and GCP. You need to ensure that security recommendations from all three cloud providers are centrally visible. What should you configure?

Accepted Answer

Onboard AWS and GCP accounts to Microsoft Defender for Cloud using the multicloud connectors feature.. The correct option is A: onboarding AWS and GCP accounts to Microsoft Defender for Cloud using the multicloud connectors feature. This is the native capability that lets Defender for Cloud pull security posture and recommendations from AWS and GCP into the same central dashboard as Azure, giving a unified view across all three clouds. Option B is wrong because Azure Policy and Azure Arc govern and configure resources but do not aggregate AWS/GCP security recommendations into Defender for Cloud. Option C is wrong because Microsoft Sentinel is a SIEM/SOAR for log ingestion and workbooks, not the mechanism that surfaces Defender for Cloud recommendations. Option D is wrong because AWS Security Hub and Google Cloud Security Command Center are separate provider-native tools and do not provide a single centralized Defender for Cloud view.

Answer

Deploy Azure Policy on AWS and GCP using Azure Arc to enforce security policies.

Answer

Ingest security logs from AWS and GCP into Microsoft Sentinel and use workbooks to view recommendations.

Answer

Connect AWS accounts to AWS Security Hub and GCP accounts to Google Cloud Security Command Center, then view via a single pane of glass.

Question 12

Your organization is deploying Microsoft Intune to manage Windows 11 devices. You need to ensure that devices automatically receive security updates and that users cannot defer updates. Which configuration profile setting should you configure?

Accepted Answer

Create a Windows 10/11 Update Rings policy with a deadline for quality and feature updates.. The correct option is B: a Windows 10/11 Update Rings policy with a deadline for quality and feature updates. Update Rings in Intune are the purpose-built mechanism for controlling Windows Update behavior on managed devices, and configuring a deadline forces installation of quality and feature updates by a set time, preventing users from deferring them indefinitely. Option A is too vague and device configuration profiles do not provide the update-ring deadline enforcement needed here. Option C only evaluates and reports compliance; it does not install updates or block deferrals. Option D concerns Defender Antivirus security settings, not Windows Update ring scheduling or deadlines.

Answer

Create a device configuration profile to enable automatic updates.

Answer

Create a compliance policy that requires the device to have the latest updates installed.

Answer

Create an endpoint security policy for Windows Defender Antivirus to enforce update installation.

Question 13

You are designing a network security architecture for an Azure application that uses Azure Front Door and Azure Application Gateway. The application must be protected from DDoS attacks and common web exploits. Application traffic should be inspected by a web application firewall (WAF) before reaching the backend. What is the recommended deployment order?

Accepted Answer

Azure Front Door with WAF in front of Azure Application Gateway with WAF.. The recommended architecture places Azure Front Door with WAF at the global edge to absorb DDoS and block common web exploits close to the client, then routes traffic to Azure Application Gateway with WAF for regional, path-based, and application-layer protection before reaching the backend. This layered approach provides defense in depth and satisfies the requirement that traffic be inspected by a WAF before reaching the backend.

Answer

Azure Front Door with WAF only, no Application Gateway.

Answer

Azure Front Door without WAF in front of Azure Application Gateway without WAF.

Answer

Azure Application Gateway with WAF in front of Azure Front Door.

Question 14

Refer to the exhibit. You run the PowerShell command to retrieve information about a Managed HSM in Azure. The output shows that the HSM is in 'Provisioned' state and has two security domains. What is the purpose of the security domains?

Accepted Answer

To back up and restore the HSM's key material and configuration.. Security domains in Azure Managed HSM are used to back up and restore the HSM's key material and configuration. A security domain is a specially encrypted blob containing the HSM's full key material and configuration, and it is the only way to restore an HSM to a new instance or recover from a total loss of the HSM. Options A, C, and D are incorrect because private endpoint connections, RBAC, and network/firewall rules are managed through Azure networking and Azure RBAC features, not through security domains.

Answer

To manage the HSM's private endpoint connections.

Answer

To enable role-based access control (RBAC) for the HSM.

Answer

To define the HSM's network access and firewall rules.

Question 15

Your company uses Microsoft Sentinel for security operations. You need to detect brute-force attacks against Azure VMs by correlating failed sign-in events from multiple sources. Which data connector should you enable?

Accepted Answer

Windows Security Events via AMA (Azure Monitor Agent) connector.. The Windows Security Events via AMA connector is correct because it collects Windows security event logs—including failed logon events (Event ID 4625)—from Azure VMs into Microsoft Sentinel, enabling correlation of brute-force attempts across multiple sources. The Microsoft Entra ID (Microsoft Entra ID) sign-in logs connector only ingests Entra ID authentication events, not local or VM-level Windows logon failures. The Syslog connector targets Linux/network device logs (e.g., via rsyslog) and does not capture Windows Security event data. The Azure Activity log connector records Azure control-plane operations (resource changes), not sign-in or authentication events.

Answer

Azure Active Directory (now Microsoft Entra ID) sign-in logs connector.

Answer

Syslog connector.

Answer

Azure Activity log connector.