SC-100 Design security solutions for infrastructure Practice Test 13 — 15 Questions

Question 1

You are designing a zero-trust network architecture for a hybrid environment using Azure Virtual WAN. You need to secure all traffic between on-premises sites and Azure virtual networks using Microsoft's security services. The solution should include next-generation firewall capabilities and TLS inspection. What should you deploy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy Azure Firewall Premium as the secured hub in Virtual WAN.. Azure Firewall Premium is the correct choice because it is the only Azure Firewall SKU that provides next-generation firewall capabilities such as TLS inspection, IDPS, and URL filtering, and it can be deployed directly as the secured hub in Azure Virtual WAN to protect all on-premises-to-Azure and inter-hub traffic. Azure Firewall Standard lacks TLS inspection and IDPS, so it cannot meet the stated requirement. A third-party NVA in a spoke virtual network would require custom routing and does not natively integrate as the Virtual WAN secured hub, adding complexity and not using Microsoft's security services as requested. Application Gateway with WAF is a Layer 7 web traffic load balancer for HTTP/HTTPS applications, not a network firewall for securing all hybrid traffic.

Answer

Deploy a third-party NVA in a spoke virtual network and route traffic through it.

Answer

Deploy Azure Firewall Standard as the secured hub in Virtual WAN.

Answer

Deploy Azure Application Gateway with WAF in each virtual network.

Question 2

Refer to the exhibit. You are reviewing an ARM template that deploys a storage account. The compliance team requires that all storage accounts use TLS 1.2 or higher. Does this template meet the requirement?

Accepted Answer

Yes, because minimumTlsVersion is set to TLS1_2.. The template meets the requirement because the storage account resource explicitly sets the minimumTlsVersion property to TLS1_2, which enforces TLS 1.2 as the minimum accepted version for all connections. This is the exact ARM property Microsoft.Storage/storageAccounts exposes for controlling the minimum TLS version, and TLS1_2 satisfies the compliance team's 'TLS 1.2 or higher' rule. Option A is wrong because the SKU Standard_GRS controls replication and redundancy, not the TLS version. Option C is wrong because supportsHttpsTrafficOnly is a separate setting that only redirects/rejects HTTP traffic; it does not by itself set the minimum TLS version, and the template already sets minimumTlsVersion. Option D is wrong because the apiVersion does support the minimumTlsVersion property, so the setting is valid.

Answer

Yes, because Standard_GRS automatically enforces TLS 1.2.

Answer

No, because supportsHttpsTrafficOnly only allows HTTPS but does not enforce TLS 1.2.

Answer

No, because the apiVersion is outdated and does not support TLS setting.

Question 3

Your organization is planning to deploy Microsoft Defender for Cloud Apps (formerly Cloud App Security). You need to discover shadow IT usage and control access to cloud apps. Which TWO capabilities should you enable? (Choose TWO.)

Accepted Answer

Conditional Access App Control. Cloud Discovery [E] is correct because it is the Defender for Cloud Apps feature that analyzes your traffic logs (from firewalls, proxies, or Defender for Endpoint) against the Cloud App Catalog to identify shadow IT usage, giving risk scores and usage analytics for discovered apps. Conditional Access App Control [A] is correct because it uses reverse-proxy deployment (via Microsoft Entra Conditional Access policies) to enforce real-time session controls—such as block download, block upload, and read-only access—on cloud apps, directly satisfying the requirement to control access to cloud apps. Intune device compliance policies [B] govern device health and compliance, not cloud app discovery or session-level app access control. DLP policies [C] protect sensitive data from exfiltration but do not perform shadow IT discovery or app access control. On-premises app discovery via Defender for Identity [D] only surfaces on-premises shadow IT (e.g., unsanctioned SaaS used from domain controllers), not the broad cloud app discovery and access control this scenario requires.

Answer

Microsoft Intune device compliance policies

Answer

Data Loss Prevention (DLP) policies

Answer

On-premises app discovery via Microsoft Defender for Identity

Question 4

You are designing a backup strategy for Azure virtual machines using Azure Backup. The solution must support cross-region restore and provide 10 years of retention for compliance. Which THREE features should you enable? (Choose THREE.)

Accepted Answer

Cross-Region Restore. Option A (Cross-Region Restore) is correct because it is the Azure Backup feature that enables restoring data from a secondary, paired Azure region when the primary region's backup data is unavailable, directly satisfying the cross-region restore requirement. Option D (Immutable vault) is correct because enabling immutability on the Recovery Services vault prevents backup data from being deleted or modified before its retention period expires, which is essential for meeting the 10-year compliance retention requirement. Option E (Archive Tier) is correct because Azure Backup's archive tier supports long-term retention of recovery points for up to 10 years at lower cost, matching the compliance retention duration. Option B (Azure Site Recovery replication) is not a backup feature but a disaster-recovery orchestration service for replicating and failing over VMs, so it does not provide the required backup retention or cross-region restore of backup data. Option C (Soft Delete) only provides a 14-day grace period to recover deleted backup data and does not deliver cross-region restore or 10-year retention, so it does not meet the stated requirements.

Answer

Azure Site Recovery replication

Answer

Soft Delete

Question 5

You are designing a security solution for an Azure Kubernetes Service (AKS) cluster that runs containerized workloads. The cluster must be integrated with Microsoft Defender for Cloud for threat detection, and you need to ensure that container images are scanned for vulnerabilities before deployment. What should you configure?

Accepted Answer

Enable Azure Defender for Containers in Microsoft Defender for Cloud and integrate with Azure Container Registry for image scanning.. The correct option is C: enabling Azure Defender for Containers in Microsoft Defender for Cloud and integrating it with Azure Container Registry provides native vulnerability scanning of container images and threat detection for AKS workloads. Defender for Containers specifically includes image scanning in ACR (on push and periodic rescanning) and surfaces findings in Defender for Cloud, which matches the requirement to scan images before deployment. Option A is wrong because Microsoft Defender for Cloud Apps is a CASB for SaaS discovery and governance, not container image scanning. Option B is wrong because Azure Policy for Kubernetes enforces configuration and admission controls but does not itself perform vulnerability scanning of images. Option D is wrong because Microsoft Sentinel is a SIEM/SOAR platform for log collection and analytics, not an image vulnerability scanner.

Answer

Enable Microsoft Defender for Cloud Apps to discover and assess container vulnerabilities.

Answer

Deploy Azure Policy for Kubernetes with built-in policies to enforce image scanning.

Answer

Configure Microsoft Sentinel to collect container logs and detect vulnerabilities.

Question 6

Your organization is implementing a security baseline for Windows 11 devices using Microsoft Intune. You need to ensure that BitLocker encryption is enabled on all devices and that recovery keys are stored in Microsoft Entra ID. Which policy type should you configure?

Accepted Answer

Endpoint security policy for disk encryption.. The correct option is B, an Endpoint security policy for disk encryption, because in Intune this policy type is purpose-built to configure BitLocker on Windows 11 and includes the setting to back up recovery keys to Microsoft Entra ID (the 'Save BitLocker recovery information to Microsoft Entra ID' option). It directly enforces encryption at the OS volume and manages key escrow to Entra ID, which is exactly the baseline requirement. Option A (administrative templates) can configure some BitLocker settings but is not the dedicated disk-encryption workload and lacks the streamlined recovery-key-to-Entra ID escrow flow. Option C (update rings) only controls Windows quality/feature update deferrals and has nothing to do with encryption. Option D (compliance policy for device encryption) only evaluates and reports whether a device is encrypted; it does not enable BitLocker or store recovery keys.

Answer

Device configuration profile for administrative templates.

Answer

Update rings for Windows 10 and later.

Answer

Compliance policy for device encryption.

Question 7

Your company is designing a hybrid identity solution using Microsoft Entra ID. You need to ensure that users can access on-premises applications using modern authentication methods. The solution must support multi-factor authentication and Conditional Access policies. What should you implement?

Accepted Answer

Microsoft Entra application proxy. Microsoft Entra application proxy publishes on-premises web applications to the cloud, letting remote users reach them through Entra ID. Because authentication flows through Entra ID, it natively supports modern authentication, MFA, and Conditional Access policies. This is the correct solution for hybrid access to on-prem apps with modern identity controls.

Answer

Microsoft Entra Connect

Answer

Azure AD Domain Services

Answer

Microsoft Intune

Question 8

You are designing a network security solution for a multi-tier application hosted in Azure. The front-end web tier must be accessible from the internet, but the back-end database tier must only accept traffic from the front-end tier. Which Azure service should you use to enforce this restriction?

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) [CORRECT] are the right choice because they let you write inbound security rules that allow traffic to the database tier only from the front-end tier's subnet or NSG (using source service tags or NSG references), while denying all other inbound traffic including internet sources. NSGs operate at the subnet/NIC level in Azure and are the standard mechanism for micro-segmentation between tiers of an application. Azure Firewall (A) is a centralized, stateful firewall for controlling outbound/inbound traffic at the VNet level, but it is not the typical tool for simple tier-to-tier allow/deny rules and is more costly and complex than needed here. Azure Bastion (C) provides secure RDP/SSH access to VMs via the Azure portal and does not restrict application-tier traffic. Application Gateway (D) is a layer-7 web traffic load balancer and WAF for the front-end web tier, not a mechanism for restricting database-tier access.

Answer

Azure Firewall

Answer

Azure Bastion

Answer

Application Gateway

Question 9

You are designing a security solution for containers in Azure Kubernetes Service (AKS). The solution must scan container images for vulnerabilities before deployment and enforce runtime security. Which combination of Microsoft Defender for Cloud features should you enable?

Accepted Answer

Microsoft Defender for Containers. Microsoft Defender for Containers (option A) is correct because it is the Defender for Cloud plan specifically designed for Kubernetes and container workloads, providing image vulnerability scanning in registries and at deployment, plus runtime threat detection for AKS clusters via the Defender sensor and admission control. It also delivers Kubernetes-native hardening recommendations and attack-path analysis, matching both the pre-deployment scanning and runtime enforcement requirements. Microsoft Defender for App Service (option B) protects web apps and App Service plans, not container images or AKS runtime. The regulatory compliance dashboard (option C) only reports against standards and does not perform vulnerability scanning or runtime protection. Microsoft Defender for Servers (option D) covers VMs and server OS workloads, not container image scanning or Kubernetes runtime security.

Answer

Microsoft Defender for App Service

Answer

Microsoft Defender for Cloud regulatory compliance dashboard

Answer

Microsoft Defender for Servers

Question 10

You need to design a backup and disaster recovery solution for Azure virtual machines that meets a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 1 hour. Which Azure service should you use?

Accepted Answer

Azure Site Recovery. Azure Site Recovery is the correct choice because it provides continuous replication of Azure VMs to a secondary region with recovery points as often as every 5 minutes, easily meeting the 1-hour RPO, and supports orchestrated failover that can bring workloads online within the 15-minute RTO. Azure Backup (D) is designed for data protection and long-term retention, with typical RPOs of once or twice per day and restore times that generally exceed 15 minutes, so it cannot meet these objectives. Azure managed disk (B) is only a storage abstraction and provides no replication or failover capability, while Azure VM snapshots (C) are point-in-time copies with no automated orchestration or cross-region recovery, so neither satisfies the RTO/RPO requirements.

Answer

Azure managed disk

Answer

Azure VM snapshot

Answer

Azure Backup

Question 11

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to design a solution to detect brute-force attacks against Azure virtual machines. The solution should use Azure Activity Logs and Windows Security Events. What should you configure in Sentinel?

Accepted Answer

Create a scheduled analytics rule. Sentinel can ingest Azure Activity Logs and Windows Events, and then use analytics rules to detect brute-force patterns. Option A is wrong because watchlists are for reference data, not detection logic. Option B is wrong because workbooks visualize data, not detect. Option D is wrong because playbooks automate responses, not detect.

Answer

Create a threat intelligence watchlist

Answer

Create a workbook

Answer

Create a playbook

Question 12

You are designing a security solution for an Azure SQL Database that stores sensitive customer data. The solution must encrypt the database at rest and in transit, and also mask sensitive columns from non-privileged users. Which combination of features should you implement?

Accepted Answer

Transparent Data Encryption (TDE) and Dynamic Data Masking (DDM). Option A is correct because Transparent Data Encryption (TDE) provides encryption at rest for Azure SQL Database by encrypting the database files, and Dynamic Data Masking (DDM) masks sensitive columns from non-privileged users by obfuscating data in query results without changing the stored data. Azure SQL Database also enforces encryption in transit by default via TLS, so TDE plus DDM satisfies the stated requirements. Option B is wrong because Always Encrypted protects data at rest and in use at the client, but it does not by itself mask columns from non-privileged users, and Row-Level Security restricts rows rather than masking columns. Option C is wrong because Always Encrypted does not provide column masking for non-privileged users. Option D is wrong because cell-level encryption and row-level security address encryption and row filtering, not the required column masking.

Answer

Always Encrypted and Row-Level Security

Answer

Always Encrypted and Dynamic Data Masking (DDM)

Answer

Cell-level encryption and row-level security

Question 13

Your company plans to migrate on-premises servers to Azure. You need to ensure that the migrated servers are protected against malware and vulnerabilities. Which Microsoft Defender for Cloud plan should you enable for the Azure VMs?

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Servers (option D) is the correct choice because it is the Defender for Cloud plan specifically designed to protect Azure VMs and on-premises servers, providing threat detection, vulnerability assessment, and malware protection through integration with Microsoft Defender for Endpoint. It covers server workloads regardless of whether they run in Azure, other clouds, or on-premises, which matches the migration scenario. The other options target different resource types: Defender for SQL (A) protects Azure SQL and SQL Server workloads, Defender for Storage (B) protects Azure Storage accounts against threats like malware uploads and data exfiltration, and Defender for Containers (C) protects Kubernetes clusters and container registries, none of which address VM-level malware and vulnerability protection.

Answer

Microsoft Defender for SQL

Answer

Microsoft Defender for Storage

Answer

Microsoft Defender for Containers

Question 14

You are designing a secure access solution for on-premises applications using Microsoft Entra ID. The solution must support modern authentication, single sign-on (SSO), and Conditional Access. Which TWO technologies should you implement?

Accepted Answer

Microsoft Entra application proxy. Microsoft Entra application proxy (C) is correct because it publishes on-premises web applications to the internet and enforces Microsoft Entra ID pre-authentication, which enables modern authentication, SSO, and Conditional Access for those apps without opening inbound firewall ports. Microsoft Entra ID as the identity provider (D) is correct because it is the cloud identity service that issues tokens, performs authentication, and evaluates Conditional Access policies for the published applications. Together, application proxy and Entra ID as the IdP provide the required modern authentication, SSO, and Conditional Access for on-premises apps. Azure AD B2C (A) is for customer-facing identity scenarios with local or social accounts, not for securing internal on-premises enterprise applications. Microsoft Entra Domain Services (B) provides managed domain services such as domain join and Group Policy, but it does not by itself publish on-premises apps or deliver the required modern auth/SSO/Conditional Access. Site-to-Site VPN (E) only provides network connectivity and does not deliver identity-based authentication, SSO, or Conditional Access.

Answer

Azure AD B2C

Answer

Microsoft Entra Domain Services

Answer

Site-to-Site VPN

Question 15

Your organization is implementing Microsoft Defender for Identity to protect on-premises Active Directory. Which THREE activities does Defender for Identity monitor?

Accepted Answer

Privilege escalation attempts. Defender for Identity is designed to detect advanced threats against on-premises Active Directory by analyzing signals from domain controllers and AD FS. Option A is correct because it identifies privilege escalation attempts, such as unauthorized additions to privileged groups or abuse of AdminSDHolder, by monitoring directory changes and authentication events. Option B is correct because it detects lateral movement techniques like Pass-the-Hash by correlating NTLM authentication anomalies and suspicious logon patterns across domain controllers. Option D is correct because it flags reconnaissance attacks that use LDAP queries to enumerate users, groups, and privileged accounts, which is a common precursor to AD attacks. Option C is not correct because file integrity monitoring on domain controllers is not a Defender for Identity capability; that is handled by other tools such as Microsoft Defender for Endpoint or File Integrity Monitoring in Defender for Cloud. Option E is not correct because Defender for Identity focuses on identity and directory signals rather than monitoring outbound network traffic to external IP addresses, which is covered by network security solutions.

Answer

File integrity changes on domain controllers

Answer

Network traffic to external IP addresses