SC-100 Design security solutions for infrastructure Practice Test 14 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing an Azure Policy definition. What does this policy do?

Accepted Answer

Denies virtual machines with managed disks if the OS disk type is not Standard_LRS or Premium_LRS. The correct option is C: the policy denies virtual machines with managed disks when the OS disk type is not Standard_LRS or Premium_LRS. This matches a typical Azure Policy definition that evaluates the managed disk's storage account type (for example, the field Microsoft.Compute/disks sku.name) and uses a deny effect to block any value outside the allowed set of Standard_LRS and Premium_LRS. Option A is wrong because encryption at host is controlled by a different setting (encryptionAtHost) and is not what this disk-type policy enforces. Option B is wrong because the policy targets managed disks, not unmanaged disks, and it does not allow unmanaged disks. Option D is wrong because the policy does not deny all VMs without managed disks; it only denies managed-disk VMs whose OS disk SKU is not Standard_LRS or Premium_LRS.

Answer

Requires all virtual machines to use encryption at host

Answer

Allows only virtual machines with unmanaged disks

Answer

Denies all virtual machines without managed disks

Question 2

Refer to the exhibit. You run the PowerShell command against an Azure SQL Database. The command returns a baseline object for rule VA2108. What does this indicate about the database's vulnerability assessment configuration?

Accepted Answer

The security team has approved the current state of rule VA2108 as acceptable. The security team has approved the current state of rule VA2108 as acceptable. In Azure SQL Database vulnerability assessment, a baseline object returned for a rule such as VA2108 means a baseline has been set for that rule, which records the current scan results as the accepted/approved state so those results are no longer flagged as findings. It does not mean automatic remediation is occurring, so A is wrong; vulnerability assessment being disabled would prevent baseline objects from being returned, so C is wrong; and a baseline does not mean there are no findings, only that the baselined results are treated as acceptable, so D is wrong.

Answer

The vulnerability assessment scan is automatically remediating findings for rule VA2108

Answer

Vulnerability assessment is disabled for this database

Answer

The database has no vulnerability findings

Question 3

You are designing a secure access strategy for a manufacturing plant using Azure IoT Hub and Azure Defender for IoT. The plant has unpatched legacy PLCs that cannot be updated. What is the best approach to prevent these devices from being compromised and used as an entry point into the corporate network?

Accepted Answer

Implement network micro-segmentation using Azure Firewall and NSGs to isolate the PLCs from the corporate network.. The correct option is B: implementing network micro-segmentation with Azure Firewall and NSGs to isolate the PLCs from the corporate network. Since the legacy PLCs cannot be patched, the most effective mitigation is to limit their attack surface and blast radius by placing them in a segmented network zone with strict allow-list rules, so a compromised PLC cannot pivot laterally into corporate systems. Azure Firewall provides centralized Layer 3–7 filtering and NSGs enforce subnet/NIC-level traffic control, which directly addresses the unpatched-device risk. Option A is wrong because a VPN gateway only provides encrypted connectivity, not isolation or traffic restriction. Option C is wrong because the Defender for IoT micro-agent requires installation and support on the device, which unpatched legacy PLCs typically cannot accommodate. Option D is wrong because TLS 1.2 only protects data in transit and does not prevent compromise or lateral movement from an unpatched PLC.

Answer

Use Azure VPN Gateway to connect PLCs to the virtual network.

Answer

Install the Microsoft Defender for IoT micro-agent on each PLC.

Answer

Enforce TLS 1.2 for all PLC communications.

Question 4

Your company uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate Exchange Online mailboxes. Which conditional access policy setting should you configure?

Accepted Answer

Grant: Require device to be marked as compliant.. The correct option is A, Grant: Require device to be marked as compliant, because this conditional access grant control evaluates the device's compliance state reported by Intune and only allows access to Exchange Online when the device meets the assigned compliance policy. This directly enforces the requirement that only compliant devices can reach corporate mailboxes. Option B, Require approved client app, restricts which apps can access the resource but does not verify device compliance. Option C, Require multifactor authentication, strengthens user sign-in verification but does not assess the device's compliance status. Option D, Require Intune enrollment, only ensures the device is managed by Intune, not that it satisfies the compliance policy.

Answer

Grant: Require approved client app.

Answer

Grant: Require multifactor authentication.

Answer

Grant: Require Intune enrollment.

Question 5

You are designing a secure solution for an Azure Kubernetes Service (AKS) cluster that hosts a critical application. You need to ensure that pods can only communicate with specific back-end services and that traffic is encrypted. What should you implement?

Accepted Answer

Implement Kubernetes network policies and enable mTLS using a service mesh like Istio or Linkerd.. Kubernetes network policies allow you to restrict pod-to-pod communication to specific back-end services, and mutual TLS (mTLS) from a service mesh like Istio or Linkerd encrypts the traffic. Option B is incorrect because network security groups (NSGs) operate at the subnet level and cannot enforce pod-level network policies. Option C is incorrect because Azure Application Gateway Ingress Controller handles inbound traffic from outside the cluster, not pod-to-pod communication. Option D is incorrect because Azure Firewall controls north-south traffic (ingress/egress) and does not manage east-west traffic between pods.

Answer

Use network security groups (NSGs) on the subnet.

Answer

Configure Azure Application Gateway Ingress Controller.

Answer

Deploy Azure Firewall and configure application rules.

Question 6

Your company uses Microsoft Sentinel as a SIEM. You need to ensure that all Azure subscription activity logs are ingested into Sentinel. What is the most efficient way to configure this?

Accepted Answer

Enable the 'Azure Activity' data connector in Sentinel.. The Azure Activity data connector is specifically designed to ingest subscription-level activity logs into Microsoft Sentinel. Option A is incorrect because although diagnostic settings can send activity logs to a Log Analytics workspace, Sentinel requires the data connector to properly collect and correlate the data. Option B is incorrect because an Azure Logic App would be an inefficient custom solution when a built-in connector exists. Option D is incorrect because manually exporting to a storage account is not efficient or automated.

Answer

Configure diagnostic settings on the subscription to send logs to a Log Analytics workspace.

Answer

Create an Azure Logic App to periodically pull activity logs.

Answer

Manually export activity logs to a storage account and connect to Sentinel.

Question 7

You are designing a secure DevOps pipeline for a critical application using GitHub Actions and Microsoft Defender for Cloud. You need to ensure that container images are scanned for vulnerabilities before being deployed to Azure Kubernetes Service (AKS). What should you implement?

Accepted Answer

Integrate Microsoft Defender for Containers with the CI/CD pipeline to scan images in Azure Container Registry.. The correct option is A: integrating Microsoft Defender for Containers with the CI/CD pipeline to scan images in Azure Container Registry. Defender for Containers provides image vulnerability scanning for ACR, and integrating it into the GitHub Actions pipeline lets you detect vulnerabilities before deployment to AKS, matching the requirement to scan images pre-deployment. Option B, GitHub Advanced Security, focuses on code and secret scanning rather than container image vulnerability assessment. Option C, Azure Policy, can audit or deny deployments based on vulnerability findings but does not itself perform image scanning in the pipeline. Option D, ACR Tasks, builds images but does not provide vulnerability scanning.

Answer

Enable GitHub Advanced Security for the repository.

Answer

Configure Azure Policy to require vulnerability assessment.

Answer

Use Azure Container Registry Tasks to build images.

Question 8

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that devices must have a minimum OS version and cannot be jailbroken. Which configuration profile type should you assign?

Accepted Answer

Compliance policy.. A compliance policy (option D) is the correct choice because Intune compliance policies are specifically designed to evaluate device health and posture, including defining a minimum OS version for iOS/iPadOS and detecting jailbroken devices via the device compliance check. When a device fails these conditions, it is marked noncompliant, which can then drive Conditional Access or other remediation actions. Device configuration policies (A) and device restrictions profiles (B) push settings to devices but do not evaluate jailbreak status or enforce a minimum OS version as a compliance condition. Enrollment restrictions (C) only control which devices or platforms are allowed to enroll, not the ongoing OS version or jailbreak state of already-enrolled devices.

Answer

Device configuration policy.

Answer

Device restrictions profile.

Answer

Enrollment restriction.

Question 9

Refer to the exhibit. You are reviewing a Bicep template for deploying an Azure SQL Database server. Which security best practice is violated?

Accepted Answer

Administrator password is hardcoded in plain text.. The administrator password is hardcoded in plain text, which violates the security best practice of never embedding secrets directly in infrastructure-as-code templates. Hardcoded credentials in a Bicep file can be exposed through source control, deployment history, or template exports, so the password should instead be supplied via a secure parameter using Key Vault or a secure string parameter. Option A is not a violation because TLS 1.2 is the minimum acceptable version for Azure SQL Database. Option C is not a violation because disabling public network access is actually a recommended security hardening measure, typically paired with private endpoints. Option D is a weaker recommendation rather than the clear violation shown, since Microsoft Entra ID authentication is encouraged but the exposed plaintext password is the definitive security flaw.

Answer

Minimal TLS version is set to 1.2, which is acceptable.

Answer

Public network access is disabled, which may affect connectivity.

Answer

Azure AD authentication is not configured.

Question 10

Which THREE components are required to implement a secure hybrid network architecture using Azure VPN Gateway? (Choose three.)

Accepted Answer

A local network gateway resource in Azure.. Option A (a local network gateway resource in Azure) is required because it defines the on-premises VPN device's public IP address and address spaces, which Azure uses as the remote endpoint for the site-to-site tunnel. Option B (a connection resource with a shared key) is required because the connection object links the virtual network gateway to the local network gateway and carries the pre-shared key (PSK) used for IKE/IPsec authentication. Option D (a virtual network gateway in Azure) is required because it is the Azure-side VPN Gateway (VpnGw SKU) that terminates the IPsec/IKE tunnel and routes traffic into the virtual network. Option C (an ExpressRoute circuit) does not belong because ExpressRoute is a private dedicated-circuit connectivity model, not a VPN Gateway component, and the scenario specifies VPN Gateway. Option E (an Azure Firewall) does not belong because it is a managed network security service for traffic filtering and is not a prerequisite for establishing a VPN Gateway site-to-site connection.

Answer

An ExpressRoute circuit.

Answer

An Azure Firewall.

Question 11

Which TWO features of Microsoft Defender for Cloud help you identify and remediate misconfigurations in your Azure environment? (Choose two.)

Accepted Answer

Security recommendations.. Security recommendations (B) is correct because Microsoft Defender for Cloud continuously assesses Azure resources against built-in and regulatory benchmarks (e.g., Azure Security Benchmark, CIS, PCI DSS) and surfaces specific, actionable remediation steps for each misconfiguration it detects. Secure score (E) is correct because it aggregates the results of those assessments into a measurable score and highlights the highest-impact misconfigurations and improvement actions, letting you prioritize and track remediation progress over time. Together, recommendations identify the misconfigurations and secure score quantifies and prioritizes them. File integrity monitoring (A) is wrong because FIM detects changes to critical OS files and registry keys on VMs, not Azure resource misconfigurations. Just-in-time VM access (C) is wrong because it reduces the attack surface by opening management ports only on demand, rather than identifying configuration issues. Adaptive application controls (D) is wrong because it uses machine-learning allowlists to control which applications can run on VMs, which is workload protection, not misconfiguration assessment.

Answer

File integrity monitoring (FIM).

Answer

Just-in-time (JIT) VM access.

Answer

Adaptive application controls.

Question 12

Your organization is planning to deploy a new web application on Azure VMs. The security team requires that all incoming traffic to the VMs be inspected by a network virtual appliance (NVA) before reaching the VMs. Which Azure networking solution should you use to route traffic through the NVA?

Accepted Answer

User Defined Routes (UDRs). User Defined Routes (UDRs) are the correct choice because they let you override Azure's default system routes and force traffic to be sent to a specific next hop, such as the private IP of a network virtual appliance, so packets are inspected before reaching the VMs. In this scenario, the security team requires traffic to pass through the NVA, which is exactly what a UDR with the NVA as the next hop accomplishes. Azure Firewall (A) is itself a managed firewall service, not the routing mechanism used to redirect traffic to a third-party NVA. Azure Load Balancer (B) distributes traffic across endpoints but does not control routing paths, and Network Security Groups (C) only filter traffic with allow/deny rules rather than steering it through an appliance.

Answer

Azure Firewall

Answer

Azure Load Balancer

Answer

Network Security Groups (NSGs)

Question 13

A company uses Azure Arc to manage on-premises servers. The security team wants to enforce that all servers (on-premises and Azure) have Microsoft Defender for Endpoint installed and running. Which solution should you use to ensure compliance across hybrid environments?

Accepted Answer

Azure Policy with Guest Configuration. Azure Policy with Guest Configuration is the correct choice because it extends Azure Policy's audit and enforcement capabilities into the operating system of both Azure VMs and Azure Arc-enabled on-premises servers, allowing you to audit and enforce settings such as whether the Microsoft Defender for Endpoint agent is installed and running. Guest Configuration assignments (built on the Guest Configuration extension and DSC-based audit/apply policies) can detect and remediate the MDE agent state across hybrid machines, which is exactly the cross-environment compliance requirement here. Microsoft Intune (A) manages device configuration and endpoint security primarily for enrolled user devices and does not provide the same Azure Policy-driven compliance enforcement for Arc-enabled servers. Azure Update Manager (C) handles patching and update compliance, not endpoint protection agent enforcement, and Microsoft Defender for Cloud (D) provides security posture and threat protection but does not itself enforce agent installation state through policy assignments.

Answer

Microsoft Intune

Answer

Azure Update Manager

Answer

Microsoft Defender for Cloud

Question 14

Your organization uses Microsoft Sentinel to monitor security events. You need to design a solution that alerts when a user account is created and then used to log in from a different country within 1 hour. Which KQL query structure should you use?

Accepted Answer

Use a join operation on AccountName with a time window. The correct option is C: use a join operation on AccountName with a time window. In Microsoft Sentinel, correlating two different event types (account creation and subsequent sign-in) across tables such as AuditLogs/SecurityEvent and SigninLogs requires joining on a common key like AccountName and constraining the time delta (e.g., using a join with a time window or a where clause on TimeGenerated difference) to detect the login within 1 hour from a different country. A single table filter (A) cannot correlate two distinct event sources, summarize with timechart (B) aggregates counts over time rather than linking creation to login, and union (D) merely concatenates rows without matching the account or enforcing the 1-hour window.

Answer

Use a single table filter with where clause

Answer

Use summarize with timechart

Answer

Use union to combine events

Question 15

Your company uses Azure DevOps to deploy infrastructure. You need to ensure that all deployed resources have specific tags for cost tracking. Which Azure policy effect should you use to prevent deployment of untagged resources?

Accepted Answer

Deny. The correct option is B, Deny, because a Deny policy effect actively blocks any deployment request that does not include the required tags, which is exactly what is needed to prevent untagged resources from being created. Deny evaluates the resource payload during deployment and returns a non-compliant error, so the resource is never provisioned. In contrast, Audit (D) only logs a non-compliance warning without stopping deployment, and DeployIfNotExists (C) remediates by deploying a related resource or applying tags after the fact rather than preventing the untagged deployment. Disabled (A) turns the policy assignment off entirely, so it has no effect at all.

Answer

Disabled

Answer

DeployIfNotExists

Answer

Audit