SC-100 Design security solutions for infrastructure Practice Test 13 — 15 Questions

Question 1

A company uses Microsoft Sentinel for SIEM and SOAR. You need to design a solution to detect and automatically respond to ransomware attacks involving mass file encryption on Windows servers. The response must include isolating the compromised server from the network, creating a backup of affected files, and resetting the user account's password. Which automation approach minimizes manual intervention?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set up an automation rule that runs a playbook to isolate the VM, trigger a backup, and reset the user password.. Microsoft Sentinel's automation rules can trigger a playbook (Logic App) that performs all three required actions: isolate the VM via Azure Automation runbook, trigger a backup, and reset the user password. Option A is incorrect because it only creates a snapshot and sends an email, missing the backup and password reset. Option B is incorrect because an alert rule triggering a runbook only isolates the VM, not the other actions. Option D is incorrect because it is a manual plan, which does not minimize manual intervention.

Answer

Use a Logic Apps playbook to create a VM snapshot and send an email to the security team.

Answer

Create an alert rule that triggers an Azure Automation runbook to isolate the VM.

Answer

Configure a manual incident response plan that includes password reset.

Question 2

Your company is deploying Azure Kubernetes Service (AKS) and needs to secure container workloads. You must ensure that only approved container images from a trusted Azure Container Registry (ACR) can be deployed. What should you implement?

Accepted Answer

Apply an Azure Policy initiative to only allow images from a specific ACR.. Azure Policy with the built-in initiative 'Only allow approved container images' enforces that containers in AKS must originate from a specified Azure Container Registry (ACR). This ensures only trusted images are deployed. Option A is incorrect because Azure AD integration controls authentication and authorization, not image source. Option C is incorrect because Azure Key Vault stores secrets and credentials, but does not enforce which images can be deployed. Option D is incorrect because network policies control traffic flow, not image approval.

Answer

Enable Azure AD integration for AKS.

Answer

Use Azure Key Vault to store container image credentials.

Answer

Configure network policies in AKS to restrict egress traffic.

Question 3

You are designing a secure access solution for a manufacturing company's IoT devices that send telemetry to Azure IoT Hub. The devices run on a private network with no internet access except through a firewall. You need to ensure that device-to-cloud communication is authenticated and encrypted, and that device credentials are rotated regularly. What should you include in the design?

Accepted Answer

Use X.509 certificates with Azure Device Provisioning Service (DPS) for automatic enrollment and certificate rotation.. X.509 certificates with auto-enrollment via DPS provide strong authentication, encryption (TLS), and automated certificate rotation. Option A is incorrect because Azure Firewall is a network security component, not an authentication mechanism. Option C is incorrect because SAS tokens require manual rotation and are less secure. Option D is incorrect because managed identities are for Azure resources, not IoT devices.

Answer

Configure Azure Firewall to authenticate and encrypt device traffic.

Answer

Use shared access signature (SAS) tokens with a central key management system.

Answer

Assign managed identities to each IoT device.

Question 4

A multinational corporation uses Microsoft Entra ID for identity and Microsoft Defender for Cloud Apps for SaaS app governance. The security team wants to deploy a conditional access policy that blocks access from untrusted locations for all cloud apps except Microsoft 365, which should only be blocked if the device is not compliant. How should you configure the policy?

Accepted Answer

Create two conditional access policies: one for all cloud apps except Microsoft 365 blocking untrusted locations, and one for Microsoft 365 requiring compliant device.. To meet the requirement, you need two separate conditional access policies. The first policy targets 'All cloud apps' excluding Microsoft 365 and blocks access from untrusted locations. The second policy targets 'Office 365' (Microsoft 365) and requires the device to be compliant, without blocking untrusted locations directly. This ensures Microsoft 365 is blocked only when the device is non-compliant, while other apps are blocked from untrusted locations. Option A is incorrect because session policies in Defender for Cloud Apps monitor but do not block access. Option C is incorrect because a single policy cannot apply different conditions to different apps. Option D is incorrect as it would block Microsoft 365 from untrusted locations regardless of device compliance.

Answer

Use a session policy in Defender for Cloud Apps to monitor non-compliant devices.

Answer

Create one conditional access policy that includes all cloud apps and requires compliant device for Microsoft 365 only.

Answer

Configure a conditional access policy that blocks access from untrusted locations for all apps.

Question 5

You are designing a secure remote access solution for employees using Windows 10/11 devices that are managed by Microsoft Intune. The solution must enforce device compliance before allowing access to corporate resources and must support single sign-on (SSO). Which technology should you use?

Accepted Answer

Use Microsoft Entra ID with Conditional Access policies that require compliant devices.. Microsoft Entra ID with Conditional Access can evaluate device compliance from Intune and provide SSO. Option A is incorrect because a traditional VPN with certificate-based authentication does not enforce device compliance beyond the certificate. Option B is incorrect because Azure AD Application Proxy is designed for on-premises applications but does not natively enforce device compliance without Conditional Access. Option C is incorrect because Microsoft Defender for Endpoint is an endpoint protection solution, not an access control mechanism; it cannot block non-compliant devices from accessing corporate resources directly.

Answer

Deploy a traditional VPN with certificate-based authentication.

Answer

Set up Azure AD Application Proxy for remote access.

Answer

Implement Microsoft Defender for Endpoint to block non-compliant devices.

Question 6

Your organization uses Azure SQL Database and needs to protect sensitive data from being exported by unauthorized users. You must implement a solution that prevents users from copying data to clipboard or taking screenshots of query results, while allowing legitimate business operations. What should you implement?

Accepted Answer

Configure a session policy in Microsoft Defender for Cloud Apps to block clipboard and screenshot actions.. Microsoft Defender for Cloud Apps session policies can monitor and control data exfiltration via reverse proxy, including blocking clipboard and screenshot actions. This prevents unauthorized export of sensitive data from Azure SQL Database query results in a browser session. Option A is incorrect because Azure Information Protection labels classify and protect files but do not prevent clipboard or screenshot actions in a database query tool. Option B is incorrect because Dynamic Data Masking only obscures sensitive data at query time but does not prevent users from copying or screenshotting the masked data. Option C is incorrect because Azure SQL Database Auditing logs activities but does not block data exfiltration actions.

Answer

Apply Azure Information Protection labels to the database.

Answer

Use Dynamic Data Masking to obscure sensitive columns.

Answer

Enable Azure SQL Database Auditing and threat detection.

Question 7

A company is migrating its on-premises Active Directory to Microsoft Entra ID. They have line-of-business applications that use Windows Integrated Authentication. You need to design a solution that allows users to access these applications from domain-joined devices without prompting for credentials, while also supporting hybrid identity. What should you implement?

Accepted Answer

Configure Microsoft Entra hybrid join and enable Seamless SSO.. Microsoft Entra hybrid join enables domain-joined devices to authenticate to Azure AD and on-premises resources with Seamless SSO, allowing users to access line-of-business applications without prompts. Option A is incorrect because PTA is an authentication method for cloud apps, not for on-prem apps, and Seamless SSO alone does not provide device-based SSO without hybrid join. Option C is incorrect because Azure AD Application Proxy requires pre-authentication and is intended for remote access, not for domain-joined devices. Option D is incorrect because AD FS is an on-prem federation service that can provide SSO but does not leverage device identity as effectively as hybrid join.

Answer

Deploy Pass-through Authentication (PTA) with Seamless SSO.

Answer

Use Azure AD Application Proxy with pre-authentication.

Answer

Implement Active Directory Federation Services (AD FS).

Question 8

You are designing a backup strategy for Azure virtual machines that host a mission-critical application. The solution must support daily backups with a retention of 30 days for daily backups, weekly backups retained for 12 weeks, and monthly backups retained for 3 years. What should you use?

Accepted Answer

Azure Backup with a backup policy that specifies daily, weekly, and monthly retention.. Azure Backup allows you to define backup policies with flexible retention rules, including daily, weekly, monthly, and yearly retention points. In this scenario, a backup policy can be configured to meet the requirements of daily backups retained for 30 days, weekly backups retained for 12 weeks, and monthly backups retained for 3 years. Option A is incorrect because Azure Files backup is for file shares, not VM-level backup. Option B is incorrect because Azure Disk Backup provides disk-level snapshots but lacks the complex retention policy needed. Option C is incorrect because Azure Site Recovery is designed for disaster recovery replication, not long-term backup retention.

Answer

Azure Files backup with a custom script.

Answer

Azure Disk Backup with a snapshot schedule.

Answer

Azure Site Recovery with a recovery plan.

Question 9

Your organization uses Microsoft Sentinel for security operations. You need to design a solution to detect and respond to lateral movement using pass-the-hash attacks. Which TWO data sources should you enable for ingestion into Microsoft Sentinel to detect such attacks?

Accepted Answer

Microsoft Defender for Identity alerts.. Correct answers: A and D. Option A: Microsoft Defender for Identity provides direct detection of pass-the-hash attacks. Option D: Windows Security Events (Event ID 4624) from domain controllers can reveal anomalous logon patterns indicative of pass-the-hash. Option B is incorrect because DNS events are not a primary source for detecting pass-the-hash; they might show network anomalies but not the attack itself. Option C is incorrect because Azure AD sign-in logs do not capture on-premises NTLM authentication events required for pass-the-hash detection. Option E is incorrect because while Sysmon logs process creation, they are not specifically targeted at pass-the-hash; other data sources are more direct.

Answer

DNS events from DNS servers.

Answer

Azure AD sign-in logs.

Answer

Sysmon logs for process creation.

Question 10

You are designing a secure CI/CD pipeline for deploying infrastructure as code (ARM templates) to Azure. The solution must detect drift from the desired state and prevent deployment of non-compliant resources. Which THREE Azure services should you incorporate?

Accepted Answer

Azure Blueprints. Correct answers: A, C, D. Azure Blueprints (or deployment stacks) define the desired state of resources. Azure Policy evaluates compliance before deployment, preventing non-compliant resources. Azure DevOps pipelines can integrate policy checks as pre-deployment gates. Option B (Azure Monitor) is for monitoring and alerting, not drift detection. Option E (Azure Resource Graph) is for querying resources, not enforcing compliance.

Answer

Azure Monitor

Answer

Azure Resource Graph

Question 11

Your organization is a large financial services company with a hybrid infrastructure consisting of on-premises servers and Azure IaaS. You are tasked with designing a security solution for infrastructure that meets the following requirements: - All administrative access to Azure resources must be just-in-time (JIT) and just-enough-access (JEA). - All on-premises servers must be managed centrally with consistent security policies. - All network traffic between on-premises and Azure must be encrypted and inspected for threats. - All privileged access must be monitored and audited. You have the following services available: Microsoft Entra ID, Microsoft Defender for Cloud, Azure Firewall, Azure Bastion, Microsoft Sentinel, Azure Arc, Azure Policy, Microsoft Defender for Identity, and Microsoft Entra Privileged Identity Management (PIM). Which combination of services should you use to meet all requirements?

Accepted Answer

Use Microsoft Entra PIM for JIT access, Azure Arc to extend Azure Policy to on-prem servers, Azure Firewall with threat intelligence for traffic inspection, and Microsoft Defender for Identity for monitoring privileged access.. It uses Microsoft Entra PIM to enforce just-in-time (JIT) and just-enough-access (JEA) for Azure roles, satisfying the administrative access requirement. Azure Arc extends Azure Policy to on-premises servers, ensuring consistent security policies across hybrid environments. Azure Firewall with threat intelligence integration can inspect encrypted traffic between on-premises and Azure, providing threat detection. Microsoft Defender for Identity monitors on-premises Active Directory for privileged attacks, meeting the monitoring requirement. Option A is incorrect: Azure Bastion only provides secure RDP/SSH access and does not provide JIT/JEA. Option C is incorrect: Microsoft Sentinel is a SIEM solution and cannot enforce JIT/JEA even with playbooks. Option D is incorrect: Permanent role assignments violate the JIT requirement, and Azure Site Recovery is for disaster recovery, not management.

Answer

Use Azure Bastion for administrative access, Azure Automation for on-prem management, Azure VPN Gateway for encrypted traffic, and Microsoft Sentinel for monitoring.

Answer

Use Microsoft Sentinel for all aspects, including JIT via playbooks, Azure Arc for management, Azure Firewall for traffic, and Azure Policy for compliance.

Answer

Use Microsoft Entra roles with permanent assignments, Azure Site Recovery for on-premises management, Azure ExpressRoute for encrypted traffic, and Microsoft Defender for Cloud for monitoring.

Question 12

You are a security architect for a healthcare organization that is adopting Microsoft 365 and Azure. The organization must comply with HIPAA and has the following requirements: - All users must use multi-factor authentication (MFA) when accessing Microsoft 365 from outside the corporate network. - Mobile devices must be managed and must be compliant before accessing email. - Access to Azure virtual machines must be limited to specific admin users and must be audited. - All sensitive data stored in Azure SQL Database must be encrypted at rest and in transit. You have the following technologies: Microsoft Entra ID, Microsoft Intune, Azure SQL Database, Azure Policy, Azure Key Vault, Microsoft Defender for Cloud, and Azure Bastion. Which combination of services and configurations should you implement?

Accepted Answer

Configure Conditional Access policies for MFA, use Intune compliance policies for mobile devices, deploy Azure Bastion for VM access with audit logging, and enable TDE and enforce TLS for Azure SQL Database.. Conditional Access policies to enforce MFA for external access; Intune compliance policies to ensure mobile devices are compliant before accessing email; Azure Bastion for secure VM access with audit logging; Transparent Data Encryption (TDE) for at-rest encryption and enforce TLS for in-transit encryption for Azure SQL Database. Option A is incorrect because Always Encrypted provides column-level encryption but TDE is a simpler and sufficient solution for at-rest encryption, and Azure AD Application Proxy is not designed for VM access. Option B is incorrect because Microsoft Entra PIM is for privileged identity management, not MFA; Azure VPN Gateway does not provide the same audit capabilities as Azure Bastion; and Double Encryption is not a standard feature for Azure SQL Database. Option D is incorrect because Azure AD Identity Protection is for risk-based policies, not MFA enforcement; Azure Firewall does not provide audit logging for VM access; and using Azure Key Vault for SQL encryption keys is part of TDE but the option lacks the full encryption configuration.

Answer

Configure Conditional Access to require MFA only for external access, use Intune for mobile device management, deploy Always Encrypted for Azure SQL Database, and use Azure AD Application Proxy for VM access.

Answer

Configure Microsoft Entra PIM for MFA, use Intune for mobile devices, deploy Azure VPN Gateway for VM access, and enable Double Encryption for Azure SQL Database.

Answer

Use Azure AD Identity Protection for MFA, use Microsoft Endpoint Manager for device compliance, deploy Azure Firewall for VM access, and use Azure Key Vault for SQL encryption keys.

Question 13

You are designing a security solution for a small business that uses Azure App Services to host a web application. The business has the following requirements: - The web application must be protected against common web vulnerabilities like SQL injection and cross-site scripting (XSS). - All traffic to the application must be encrypted. - The solution should be cost-effective and require minimal management overhead. - The application must be able to scale automatically based on demand. Which Azure service should you use to meet these requirements?

Accepted Answer

Deploy Azure Application Gateway with Web Application Firewall (WAF) in front of the App Service.. Azure Application Gateway with Web Application Firewall (WAF) provides protection against common web vulnerabilities like SQL injection and cross-site scripting (XSS), offers TLS termination for encrypted traffic, supports autoscaling, and is a cost-effective managed service suitable for a small business. Option A is incorrect: Azure Firewall is a network firewall that does not provide web application–layer protection. Option B is incorrect: Azure CDN can deliver content and enforce HTTPS but does not include WAF capabilities. Option C is incorrect: Azure Front Door also includes WAF but is designed for global multi-region deployments and incurs higher costs, making it less optimal for a single-region small business application.

Answer

Use Azure Firewall to inspect traffic to the App Service.

Answer

Use Azure CDN with custom domain and HTTPS.

Answer

Deploy Azure Front Door with WAF policies.

Question 14

Your organization is planning to deploy Microsoft Defender for Cloud to protect a hybrid environment that includes on-premises servers and Azure virtual machines. You need to ensure that the security recommendations and threat detections are consistently applied across all resources. What should you configure?

Accepted Answer

Enable auto-provisioning for the Log Analytics agent on all subscriptions.. Enabling auto-provisioning for the Log Analytics agent ensures that all existing and future Azure VMs and, via Azure Arc, on-premises servers are automatically monitored by Microsoft Defender for Cloud, allowing security recommendations and threat detections to be consistently applied across all resources. Option A is incorrect because Azure Arc enables management of on-premises servers but does not by itself ensure consistent security policy application; it must be combined with auto-provisioning or policy. Option C is incorrect because configuring an Azure Policy to require deployment of the Log Analytics agent does not automatically deploy it; it only checks compliance. Option D is incorrect because assigning the 'Deploy Log Analytics agent' initiative to a management group will audit or deploy the agent to Azure VMs but does not cover on-premises servers unless they are Azure Arc-enabled, and auto-provisioning is the simpler mechanism to ensure consistent monitoring across all resources.

Answer

Connect on-premises servers using Azure Arc and assign a built-in policy initiative.

Answer

Configure an Azure Policy to require the deployment of the Log Analytics agent.

Answer

Use Azure Policy to assign the 'Deploy Log Analytics agent' initiative to the management group.

Question 15

Your company uses Azure Firewall to secure outbound traffic from a hub virtual network that contains multiple spoke virtual networks. You need to implement a solution that allows traffic from specific spoke VMs to reach a specific external SaaS endpoint, while blocking all other outbound traffic. The SaaS endpoint uses a dynamic set of IP addresses that change frequently. What should you do?

Accepted Answer

Configure Azure Firewall application rules using FQDN tags to allow traffic to the SaaS endpoint.. Azure Firewall application rules using FQDN tags allow you to permit traffic to a specific SaaS endpoint by its FQDN, which resolves to frequently changing IP addresses automatically. This is ideal for dynamic IP scenarios. Option A is incorrect because network rules based on static IP ranges cannot handle dynamic IP changes. Option B is incorrect because Azure Firewall Manager is a management tool, not a solution for filtering traffic based on FQDN. Option C is incorrect because service tags are for Azure services, not external SaaS endpoints.

Answer

Configure Azure Firewall network rules to allow traffic to the SaaS endpoint's current IP range.

Answer

Deploy Azure Firewall Manager and enable threat intelligence-based filtering.

Answer

Use Azure Firewall service tags to allow traffic to the SaaS endpoint.