SC-100 Design security solutions for infrastructure Practice Test 14 — 15 Questions

Question 1

A company is migrating its on-premises Active Directory to Microsoft Entra ID. They have line-of-business applications that use Windows Integrated Authentication. You need to design a solution that allows users to access these applications from domain-joined devices without prompting for credentials, while also supporting hybrid identity. What should you implement?

Accepted Answer

Configure Microsoft Entra hybrid join and enable Seamless SSO.. Option D is correct because Microsoft Entra hybrid join allows domain-joined devices to authenticate to both on-prem and cloud resources, enabling SSO. Option A is incorrect because Azure AD Application Proxy requires separate authentication. Option B is incorrect because Pass-through Authentication is for cloud apps, not on-prem. Option C is incorrect because Federation does not provide device-based SSO for on-prem apps.

Answer

Deploy Pass-through Authentication (PTA) with Seamless SSO.

Answer

Use Azure AD Application Proxy with pre-authentication.

Answer

Implement Active Directory Federation Services (AD FS).

Question 2

You are designing a backup strategy for Azure virtual machines that host a mission-critical application. The solution must support daily backups with a retention of 30 days for daily backups, weekly backups retained for 12 weeks, and monthly backups retained for 3 years. What should you use?

Accepted Answer

Azure Backup with a backup policy that specifies daily, weekly, and monthly retention.. Option A is correct because Azure Backup allows you to define backup policies with multiple retention points (daily, weekly, monthly, yearly). Option B is incorrect because Azure Site Recovery is for disaster recovery, not long-term retention. Option C is incorrect because Azure Disk Backup is for disk-level backups and does not support complex retention. Option D is incorrect because Azure Files backup is for file shares.

Answer

Azure Files backup with a custom script.

Answer

Azure Disk Backup with a snapshot schedule.

Answer

Azure Site Recovery with a recovery plan.

Question 3

Your organization uses Microsoft Sentinel for security operations. You need to design a solution to detect and respond to lateral movement using pass-the-hash attacks. Which TWO data sources should you enable for ingestion into Microsoft Sentinel to detect such attacks?

Accepted Answer

Microsoft Defender for Identity alerts.. Correct answers: A and D. Windows Security Events (Event ID 4624) can show anomalous logons, and Microsoft Defender for Identity provides detection of pass-the-hash. Option B is incorrect: Azure AD sign-in logs do not capture on-prem NTLM events. Option C is incorrect: Sysmon is helpful but not specifically for pass-the-hash. Option E is incorrect: DNS logs are for network anomalies.

Answer

DNS events from DNS servers.

Answer

Azure AD sign-in logs.

Answer

Sysmon logs for process creation.

Question 4

You are designing a secure CI/CD pipeline for deploying infrastructure as code (ARM templates) to Azure. The solution must detect drift from the desired state and prevent deployment of non-compliant resources. Which THREE Azure services should you incorporate?

Accepted Answer

Azure Blueprints. Correct answers: A, B, D. Azure Policy can evaluate compliance before deployment, Azure Blueprints (or its replacement, deployment stacks) define the desired state, and Azure DevOps pipelines can run pre-deployment checks. Option C is incorrect: Azure Resource Graph is for querying resources, not enforcing. Option E is incorrect: Azure Monitor is for monitoring, not drift detection.

Answer

Azure Monitor

Answer

Azure Resource Graph

Question 5

A company wants to secure its Azure Kubernetes Service (AKS) cluster. They need to ensure that pods cannot communicate with each other unless explicitly allowed, and that secrets are encrypted at rest. Which TWO security controls should they implement?

Accepted Answer

Use Azure Key Vault with Secrets Store CSI driver for secret management.. Correct answers: A and C. Network policies in Kubernetes can restrict pod-to-pod communication, and Azure Key Vault with CSI driver allows secrets to be encrypted and stored externally. Option B is incorrect: Azure AD integration is for authentication, not network or encryption. Option D is incorrect: Azure Policy can enforce image source, not pod communication. Option E is incorrect: Container insights is for monitoring.

Answer

Apply Azure Policy to restrict container image sources.

Answer

Enable Container insights for monitoring.

Answer

Enable Azure AD integration for the AKS cluster.

Question 6

Your organization is a large financial services company with a hybrid infrastructure consisting of on-premises servers and Azure IaaS. You are tasked with designing a security solution for infrastructure that meets the following requirements: - All administrative access to Azure resources must be just-in-time (JIT) and just-enough-access (JEA). - All on-premises servers must be managed centrally with consistent security policies. - All network traffic between on-premises and Azure must be encrypted and inspected for threats. - All privileged access must be monitored and audited. You have the following services available: Microsoft Entra ID, Microsoft Defender for Cloud, Azure Firewall, Azure Bastion, Microsoft Sentinel, Azure Arc, Azure Policy, Microsoft Defender for Identity, and Microsoft Entra Privileged Identity Management (PIM). Which combination of services should you use to meet all requirements?

Accepted Answer

Use Microsoft Entra PIM for JIT access, Azure Arc to extend Azure Policy to on-prem servers, Azure Firewall with threat intelligence for traffic inspection, and Microsoft Defender for Identity for monitoring privileged access.. Option A is correct: PIM provides JIT/JEA for Azure roles; Azure Arc enables management of on-prem servers with Azure Policy; Azure Firewall with threat intelligence can inspect encrypted traffic; Microsoft Defender for Identity monitors on-prem AD for privileged attacks. Option B is incorrect: Azure Bastion provides secure RDP/SSH but does not provide JIT/JEA. Option C is incorrect: Azure VPN Gateway does not inspect traffic. Option D is incorrect: Microsoft Sentinel is for SIEM, not JIT.

Answer

Use Azure Bastion for administrative access, Azure Automation for on-prem management, Azure VPN Gateway for encrypted traffic, and Microsoft Sentinel for monitoring.

Answer

Use Microsoft Sentinel for all aspects, including JIT via playbooks, Azure Arc for management, Azure Firewall for traffic, and Azure Policy for compliance.

Answer

Use Microsoft Entra roles with permanent assignments, Azure Site Recovery for on-premises management, Azure ExpressRoute for encrypted traffic, and Microsoft Defender for Cloud for monitoring.

Question 7

You are a security architect for a healthcare organization that is adopting Microsoft 365 and Azure. The organization must comply with HIPAA and has the following requirements: - All users must use multi-factor authentication (MFA) when accessing Microsoft 365 from outside the corporate network. - Mobile devices must be managed and must be compliant before accessing email. - Access to Azure virtual machines must be limited to specific admin users and must be audited. - All sensitive data stored in Azure SQL Database must be encrypted at rest and in transit. You have the following technologies: Microsoft Entra ID, Microsoft Intune, Azure SQL Database, Azure Policy, Azure Key Vault, Microsoft Defender for Cloud, and Azure Bastion. Which combination of services and configurations should you implement?

Accepted Answer

Configure Conditional Access policies for MFA, use Intune compliance policies for mobile devices, deploy Azure Bastion for VM access with audit logging, and enable TDE and enforce TLS for Azure SQL Database.. Option B is correct: Conditional Access with MFA for external access; Intune compliance policies for mobile devices; Azure Bastion for secure VM access with audit; Transparent Data Encryption (TDE) for at-rest encryption and TLS for in-transit. Option A is incorrect: Always Encrypted is for column-level encryption, but TDE is simpler for HIPAA. Option C is incorrect: Azure AD Application Proxy is not for VM access. Option D is incorrect: Azure Firewall does not provide audit for VM access.

Answer

Configure Conditional Access to require MFA only for external access, use Intune for mobile device management, deploy Always Encrypted for Azure SQL Database, and use Azure AD Application Proxy for VM access.

Answer

Configure Microsoft Entra PIM for MFA, use Intune for mobile devices, deploy Azure VPN Gateway for VM access, and enable Double Encryption for Azure SQL Database.

Answer

Use Azure AD Identity Protection for MFA, use Microsoft Endpoint Manager for device compliance, deploy Azure Firewall for VM access, and use Azure Key Vault for SQL encryption keys.

Question 8

You are designing a security solution for a small business that uses Azure App Services to host a web application. The business has the following requirements: - The web application must be protected against common web vulnerabilities like SQL injection and cross-site scripting (XSS). - All traffic to the application must be encrypted. - The solution should be cost-effective and require minimal management overhead. - The application must be able to scale automatically based on demand. Which Azure service should you use to meet these requirements?

Accepted Answer

Deploy Azure Application Gateway with Web Application Firewall (WAF) in front of the App Service.. Option A is correct: Azure Web Application Firewall (WAF) on Application Gateway protects against web vulnerabilities, provides TLS termination, and supports autoscaling. Option B is incorrect: Azure Front Door also provides WAF but is more expensive and suited for global scenarios. Option C is incorrect: Azure CDN does not include WAF. Option D is incorrect: Azure Firewall is a network firewall, not a web application firewall.

Answer

Use Azure Firewall to inspect traffic to the App Service.

Answer

Use Azure CDN with custom domain and HTTPS.

Answer

Deploy Azure Front Door with WAF policies.

Question 9

Your organization is planning to deploy Microsoft Defender for Cloud to protect a hybrid environment that includes on-premises servers and Azure virtual machines. You need to ensure that the security recommendations and threat detections are consistently applied across all resources. What should you configure?

Accepted Answer

Enable auto-provisioning for the Log Analytics agent on all subscriptions.. Option A is correct because enabling auto-provisioning for the Log Analytics agent ensures that all existing and future VMs (both on-premises and Azure) are automatically monitored and security recommendations are applied consistently. Option B is wrong because Azure Arc is for managing on-premises machines, but it does not by itself provide consistent security policy application. Option C is wrong because just assigning a policy does not enforce monitoring. Option D is wrong because Azure Policy is used to enforce compliance, but it does not replace the need for auto-provisioning.

Answer

Connect on-premises servers using Azure Arc and assign a built-in policy initiative.

Answer

Configure an Azure Policy to require the deployment of the Log Analytics agent.

Answer

Use Azure Policy to assign the 'Deploy Log Analytics agent' initiative to the management group.

Question 10

Your company uses Azure Firewall to secure outbound traffic from a hub virtual network that contains multiple spoke virtual networks. You need to implement a solution that allows traffic from specific spoke VMs to reach a specific external SaaS endpoint, while blocking all other outbound traffic. The SaaS endpoint uses a dynamic set of IP addresses that change frequently. What should you do?

Accepted Answer

Configure Azure Firewall application rules using FQDN tags to allow traffic to the SaaS endpoint.. Option B is correct because using Azure Firewall with fully qualified domain name (FQDN) tags allows you to allow traffic to a specific SaaS endpoint by its FQDN, even if IP addresses change dynamically. Option A is wrong because network rules based on IP addresses cannot handle dynamic IP changes. Option C is wrong because service tags are used for Azure services, not external SaaS endpoints. Option D is wrong because Azure Firewall Manager is for managing multiple firewalls, not for solving dynamic IP filtering.

Answer

Configure Azure Firewall network rules to allow traffic to the SaaS endpoint's current IP range.

Answer

Deploy Azure Firewall Manager and enable threat intelligence-based filtering.

Answer

Use Azure Firewall service tags to allow traffic to the SaaS endpoint.

Question 11

Your organization is deploying a new application on Azure Kubernetes Service (AKS). You need to ensure that only authorized containers can run in the cluster and that any unauthorized containers are automatically blocked. What should you configure?

Accepted Answer

Apply an Azure Policy that restricts container images to only those from approved registries.. Option A is correct because Azure Policy for AKS, using the built-in 'Kubernetes cluster containers should only use allowed images' policy, ensures that only images from approved registries can run. Option B is wrong because Azure RBAC controls who can manage the cluster, not which containers run. Option C is wrong because network policies control traffic, not container authorization. Option D is wrong because Azure AD integration controls authentication, not container image approval.

Answer

Implement network policies to restrict communication between pods.

Answer

Enable Azure AD integration for the AKS cluster.

Answer

Configure Azure RBAC roles to limit who can deploy containers.

Question 12

Refer to the exhibit. You are reviewing an Azure Policy definition that is assigned to a subscription containing several virtual machines. After the assignment, users report that they cannot create new VMs. What is the most likely reason?

Accepted Answer

The policy denies creation of VMs that do not use managed disks.. Option A is correct because the policy denies creation of VMs that do not use managed disks. The condition checks if the osDisk.managedDisk field does not exist, and if so, denies the request. Therefore, any attempt to create a VM with unmanaged disks will be denied. Option B is wrong because the policy only denies creation, it does not affect existing VMs. Option C is wrong because the policy denies all VMs without managed disks, not just those with a specific size. Option D is wrong because the policy does not require premium SSDs; it only requires managed disks.

Answer

The policy denies creation of VMs with a specific size.

Answer

The policy denies creation of VMs that use managed disks.

Answer

The policy denies creation of VMs that do not use premium SSDs.

Question 13

Your company plans to use Microsoft Defender for Cloud to protect its Azure resources. You need to enable just-in-time (JIT) VM access to reduce the attack surface. Which TWO configurations are required to implement JIT access?

Accepted Answer

Enable JIT VM access in Microsoft Defender for Cloud.. Option B is correct because JIT access requires enabling it in Defender for Cloud for the VMs. Option D is correct because JIT access requires an Azure Policy to enforce the JIT configuration. Option A is wrong because a network security group (NSG) is used, but it is not a separate requirement; JIT automatically configures NSG rules. Option C is wrong because Azure Bastion is a separate service for secure RDP/SSH access, not required for JIT. Option E is wrong because a Log Analytics workspace is used for monitoring, but not required for JIT.

Answer

Deploy Azure Bastion for secure RDP/SSH connectivity.

Answer

Configure a Log Analytics workspace to collect JIT logs.

Answer

Create a network security group (NSG) that allows all inbound traffic.

Question 14

Your organization is implementing a defense-in-depth strategy for a multi-tier application hosted on Azure. You need to secure the network layers. Which THREE measures should you implement?

Accepted Answer

Enable Azure DDoS Protection on the virtual network.. Option B is correct because Azure Firewall provides centralized inbound and outbound traffic filtering. Option C is correct because network security groups (NSGs) provide micro-segmentation at the subnet or NIC level. Option D is correct because Azure DDoS Protection helps mitigate volumetric attacks. Option A is wrong because a VPN gateway is for connectivity, not a network security layer. Option E is wrong because Azure Front Door is an application delivery and security service, but it is not a general network security layer for all tiers; it is more specific to web applications.

Answer

Configure Azure Front Door to protect the application layer.

Answer

Deploy a site-to-site VPN gateway.

Question 15

You are designing a secure infrastructure for an Azure Kubernetes Service (AKS) cluster that will host sensitive workloads. Which TWO configurations should you implement to secure the cluster?

Accepted Answer

Enable Azure AD integration for role-based access control (RBAC).. Option A is correct because enabling Azure AD integration allows you to use Azure AD identities for cluster authentication. Option C is correct because using pod identity allows pods to authenticate to Azure resources securely. Option B is wrong because cluster autoscaler scales nodes, not security. Option D is wrong because Azure Monitor provides monitoring, not security. Option E is wrong because the HTTP application routing add-on is for ingress, not security.

Answer

Enable Azure Monitor for containers.

Answer

Enable the HTTP application routing add-on.

Answer

Enable the cluster autoscaler.