SC-100 Design security solutions for infrastructure Practice Test 13 — 15 Questions

Question 1

Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You are designing a solution to protect against password spray attacks. You need to implement a solution that can detect and block malicious authentication attempts in real-time. What should you use?

Accepted Answer

Microsoft Entra ID Protection with Conditional Access policies.. Option A is correct because Entra ID Identity Protection provides real-time risk detection and conditional access policies to block risky sign-ins, including password spray. Option B is wrong because Microsoft Defender for Identity focuses on on-premises AD attacks, not cloud authentication. Option C is wrong because Azure AD MFA is a verification method, not a detection mechanism. Option D is wrong because password hash sync is for synchronization, not detection.

Answer

Microsoft Defender for Identity with a VPN integration.

Answer

Azure AD Multi-Factor Authentication (MFA) enforced for all users.

Answer

Password hash synchronization with Azure AD Connect.

Question 2

You are designing a secure CI/CD pipeline for Azure using GitHub Actions. You need to ensure that secrets (e.g., Azure service principal credentials) are stored securely and accessed only by authorized actions. What should you use?

Accepted Answer

Use GitHub Actions secrets to store the credentials.. Option B is correct because GitHub Actions secrets are encrypted and can be scoped to repositories or environments. Option A is wrong because storing secrets in code is insecure. Option C is wrong because Key Vault can be accessed from GitHub Actions via a secret, but the primary secure storage for GitHub is secrets. Option D is wrong because managed identities are not directly usable in GitHub Actions without a secret to authenticate.

Answer

Use Azure AD managed identities for GitHub Actions.

Answer

Store secrets in Azure Key Vault and access them using a service principal secret stored in GitHub.

Answer

Store secrets as environment variables in the GitHub repository.

Question 3

Your organization is designing a Microsoft Sentinel workspace for a multi-region deployment. You need to optimize cost while ensuring that security data is available for investigation in the primary region. Which TWO actions should you take?

Accepted Answer

Use a single Sentinel workspace in the primary region and ingest data from all regions via diagnostic settings.. Option A is correct because using a single workspace across regions avoids duplicate data ingestion and cost. Option C is correct because using Azure Lighthouse allows centralized management across regions. Option B is wrong because multiple workspaces increase cost and management overhead. Option D is wrong because it doesn't directly address cost optimization. Option E is wrong because separate workspaces increase cost.

Answer

Enable Azure Monitor Agent (AMA) with data collection rules to filter logs.

Answer

Use Log Analytics clusters with dedicated clusters to reduce costs.

Answer

Deploy Sentinel workspaces in each region and use cross-workspace queries.

Question 4

You are designing a secure data exfiltration protection solution for Azure Storage accounts. You need to prevent data from being copied to unauthorized external locations. Which THREE controls should you implement?

Accepted Answer

Enable Microsoft Defender for Storage and configure alerts for anomalous data extraction.. Option A is correct because NSGs can restrict egress traffic at the subnet level. Option C is correct because Azure Firewall can inspect outbound traffic and block unauthorized destinations. Option E is correct because Microsoft Defender for Storage alerts on anomalous data transfers. Option B is wrong because private endpoints do not prevent exfiltration; they prevent public access. Option D is wrong because soft delete is for recovery, not exfiltration prevention.

Answer

Use Azure Private Endpoints for all storage accounts.

Answer

Enable soft delete and versioning for blobs.

Question 5

Your company is planning to use Microsoft Intune for mobile device management (MDM). You need to ensure that devices are compliant before accessing corporate resources. Which TWO components should you configure?

Accepted Answer

Conditional Access policies in Microsoft Entra ID.. Option B is correct because compliance policies define the conditions for device compliance. Option D is correct because Conditional Access policies enforce access based on compliance. Option A is wrong because configuration policies are for settings, not compliance. Option C is wrong because app protection policies are for app-level, not device-level compliance. Option E is wrong because enrollment restrictions are for device enrollment, not compliance.

Answer

Device configuration policies.

Answer

Enrollment restrictions.

Answer

App protection policies.

Question 6

You are a security architect for a large financial services company. The company has a hybrid identity infrastructure with on-premises Active Directory and Microsoft Entra ID (Azure AD). They have recently suffered a password spray attack that compromised several accounts. Management wants to implement a Zero Trust security model and has mandated the following requirements: 1. All user authentication must be protected by phishing-resistant MFA. 2. Legacy authentication protocols must be blocked. 3. All sign-in risks must be detected and automatically remediated. The current environment includes: - Microsoft 365 E5 licenses for all users. - Microsoft Entra ID P2 licenses. - On-premises Active Directory with password hash sync. - Azure AD Application Proxy for publishing on-premises apps. - A third-party VPN solution for remote access. You need to design a solution that meets the requirements. What should you do?

Accepted Answer

Deploy Windows Hello for Business for all users. Configure Conditional Access policies to block legacy authentication and require MFA for all cloud apps. Use Entra ID Protection to detect risky sign-ins and automatically require password change or block access.. Option A is correct because Windows Hello for Business is a phishing-resistant MFA method. Entra ID Conditional Access can block legacy authentication and enforce risk-based policies. Entra ID Protection detects sign-in risks and can automatically block or require password change. Option B is wrong because the Authenticator app (OATH TOTP) is not phishing-resistant (vulnerable to MFA fatigue). Option C is wrong because FIDO2 security keys are phishing-resistant but they are hardware tokens, not the recommended for all users; also the scenario doesn't mention hardware deployment. Option D is wrong because Azure AD MFA with phone call is not phishing-resistant.

Answer

Enable Azure AD MFA with phone call for all users. Use Conditional Access to block legacy authentication. Use Identity Protection to detect risks and require MFA again.

Answer

Enable Azure AD MFA with the Microsoft Authenticator app (OATH TOTP). Use Conditional Access to block legacy authentication and require MFA. Configure Identity Protection to alert on risky sign-ins.

Answer

Deploy FIDO2 security keys to all users. Configure Conditional Access to block legacy authentication. Use Identity Protection to detect risks and send alerts to the SOC.

Question 7

You are a security architect for a software development company. The company uses GitHub for source control and Azure DevOps for CI/CD. They have a large number of repositories and want to ensure that secrets (e.g., API keys, connection strings) are never committed to code. They also want to scan pull requests for secrets before merging. The company has Microsoft Defender for Cloud and Microsoft Purview available. You need to design a solution that prevents secret leaks. What should you use?

Accepted Answer

Enable GitHub secret scanning for all repositories. Configure push protection to block commits containing secrets. Use custom patterns to scan for company-specific secrets.. Option A is correct because GitHub secret scanning is built into GitHub and can scan for known secret patterns; it can also be extended with custom patterns. It can block pushes that contain secrets. Option B is wrong because Azure Key Vault is a storage for secrets, not a scanning tool. Option C is wrong because Defender for Cloud does not scan GitHub repositories for secrets. Option D is wrong because Microsoft Purview Information Protection is for data classification, not secret scanning in code.

Answer

Enable Microsoft Defender for Cloud's 'Secrets scanning' feature for GitHub repositories.

Answer

Use Azure Key Vault to store secrets and enforce policies that require developers to use Key Vault references.

Answer

Use Microsoft Purview Information Protection to scan repositories and classify secrets.

Question 8

You are a security architect for a retail company that uses Microsoft 365 and Azure. The company has a large number of remote employees who use both company-managed and personal devices. You need to design a solution to ensure that only compliant devices can access corporate email (Exchange Online) and files (SharePoint Online). The company has Microsoft Intune and Microsoft Entra ID P1 licenses. You need to implement device-based conditional access. What should you do?

Accepted Answer

Enroll devices in Intune, create compliance policies, and configure Conditional Access policies in Entra ID to require compliant devices.. Option B is correct because Intune compliance policies define device health requirements, and Conditional Access policies enforce access based on compliance. Option A is wrong because app protection policies are for mobile application management (MAM) without device enrollment, but the requirement is device-based. Option C is wrong because device enrollment itself does not enforce compliance. Option D is wrong because Configuration Manager is for on-premises management, not cloud devices.

Answer

Deploy app protection policies (MAM) in Intune to protect data in Exchange Online and SharePoint Online.

Answer

Require all devices to be enrolled in Intune using automatic enrollment via Group Policy.

Answer

Use Microsoft Endpoint Configuration Manager to manage device compliance and integrate with Entra ID.

Question 9

Your organization plans to use Microsoft Defender for Cloud to protect hybrid workloads across Azure and on-premises servers. You need to ensure that security policies are consistently applied and that compliance status is monitored centrally. What should you configure?

Accepted Answer

Create Azure Policy initiatives and assign them to management groups and subscriptions.. Option B is correct because Azure Policy allows defining and enforcing security policies across Azure and hybrid environments via Arc-enabled servers. Option A is incorrect because Azure Blueprints are deprecated in favor of deployment stacks. Option C is incorrect because Defender for Cloud's security policies are built on Azure Policy. Option D is incorrect because Azure Security Benchmark is a set of guidelines, not a configuration mechanism.

Answer

Implement Azure Security Benchmark recommendations manually.

Answer

Configure security policies directly in Microsoft Defender for Cloud.

Answer

Deploy Azure Blueprints to assign policies to management groups.

Question 10

A company uses Microsoft Sentinel for SIEM and SOAR. You need to design a solution to detect and automatically respond to ransomware attacks involving mass file encryption on Windows servers. The response must include isolating the compromised server from the network, creating a backup of affected files, and resetting the user account's password. Which automation approach minimizes manual intervention?

Accepted Answer

Set up an automation rule that runs a playbook to isolate the VM, trigger a backup, and reset the user password.. Option D is correct because Microsoft Sentinel's automation rules can trigger a playbook (Logic App) that performs all three actions: isolate VM via Azure Automation runbook, trigger backup via Azure Backup APIs, and reset password via Microsoft Graph. Option A is incorrect because it only isolates. Option B is incorrect because it only creates backups. Option C is incorrect because it only resets the password.

Answer

Use a Logic Apps playbook to create a VM snapshot and send an email to the security team.

Answer

Create an alert rule that triggers an Azure Automation runbook to isolate the VM.

Answer

Configure a manual incident response plan that includes password reset.

Question 11

Your company is deploying Azure Kubernetes Service (AKS) and needs to secure container workloads. You must ensure that only approved container images from a trusted Azure Container Registry (ACR) can be deployed. What should you implement?

Accepted Answer

Apply an Azure Policy initiative to only allow images from a specific ACR.. Option C is correct because Azure Policy with the 'Only allow approved container images' built-in initiative enforces that containers in AKS must originate from a specified ACR. Option A is incorrect because network policies control traffic, not image source. Option B is incorrect because Azure AD integration controls authentication, not image source. Option D is incorrect because Azure Key Vault stores secrets, not image approval.

Answer

Enable Azure AD integration for AKS.

Answer

Use Azure Key Vault to store container image credentials.

Answer

Configure network policies in AKS to restrict egress traffic.

Question 12

You are designing a secure access solution for a manufacturing company's IoT devices that send telemetry to Azure IoT Hub. The devices run on a private network with no internet access except through a firewall. You need to ensure that device-to-cloud communication is authenticated and encrypted, and that device credentials are rotated regularly. What should you include in the design?

Accepted Answer

Use X.509 certificates with Azure Device Provisioning Service (DPS) for automatic enrollment and certificate rotation.. Option A is correct because X.509 certificates with auto-enrollment via DPS provide strong authentication, encryption (TLS), and automated certificate rotation. Option B is incorrect because SAS tokens require manual rotation and are less secure. Option C is incorrect because managed identities are for Azure resources, not IoT devices. Option D is incorrect because Azure Firewall is a network security component, not an authentication mechanism.

Answer

Configure Azure Firewall to authenticate and encrypt device traffic.

Answer

Use shared access signature (SAS) tokens with a central key management system.

Answer

Assign managed identities to each IoT device.

Question 13

A multinational corporation uses Microsoft Entra ID for identity and Microsoft Defender for Cloud Apps for SaaS app governance. The security team wants to deploy a conditional access policy that blocks access from untrusted locations for all cloud apps except Microsoft 365, which should only be blocked if the device is not compliant. How should you configure the policy?

Accepted Answer

Create two conditional access policies: one for all cloud apps except Microsoft 365 blocking untrusted locations, and one for Microsoft 365 requiring compliant device.. Option D is correct because you can use two policies: one targeting 'All cloud apps' blocking untrusted locations (excluding Microsoft 365), and another targeting 'Office 365' requiring compliant device. Option A is incorrect because a single policy cannot have different conditions for different apps. Option B is incorrect because session controls are for monitoring, not blocking. Option C is incorrect because blocking access would be too restrictive.

Answer

Use a session policy in Defender for Cloud Apps to monitor non-compliant devices.

Answer

Create one conditional access policy that includes all cloud apps and requires compliant device for Microsoft 365 only.

Answer

Configure a conditional access policy that blocks access from untrusted locations for all apps.

Question 14

You are designing a secure remote access solution for employees using Windows 10/11 devices that are managed by Microsoft Intune. The solution must enforce device compliance before allowing access to corporate resources and must support single sign-on (SSO). Which technology should you use?

Accepted Answer

Use Microsoft Entra ID with Conditional Access policies that require compliant devices.. Option B is correct because Microsoft Entra ID with Conditional Access can evaluate device compliance from Intune and provide SSO. Option A is incorrect because VPN alone does not enforce device compliance. Option C is incorrect because Microsoft Defender for Endpoint is an endpoint protection solution, not an access control mechanism. Option D is incorrect because Azure AD Application Proxy is for on-prem apps, but it does not natively enforce device compliance without Conditional Access.

Answer

Deploy a traditional VPN with certificate-based authentication.

Answer

Set up Azure AD Application Proxy for remote access.

Answer

Implement Microsoft Defender for Endpoint to block non-compliant devices.

Question 15

Your organization uses Azure SQL Database and needs to protect sensitive data from being exported by unauthorized users. You must implement a solution that prevents users from copying data to clipboard or taking screenshots of query results, while allowing legitimate business operations. What should you implement?

Accepted Answer

Configure a session policy in Microsoft Defender for Cloud Apps to block clipboard and screenshot actions.. Option C is correct because Microsoft Defender for Cloud Apps session policies can monitor and control data exfiltration via reverse proxy, including blocking clipboard and screenshot actions. Option A is incorrect because Azure SQL Database Auditing logs activities but does not prevent them. Option B is incorrect because Dynamic Data Masking obfuscates data but does not prevent export. Option D is incorrect because Azure Information Protection labels files but does not prevent clipboard actions in a browser.

Answer

Apply Azure Information Protection labels to the database.

Answer

Use Dynamic Data Masking to obscure sensitive columns.

Answer

Enable Azure SQL Database Auditing and threat detection.