SC-100 Design security solutions for infrastructure Practice Test 14 — 15 Questions

Question 1

Your organization is deploying a new application on Azure Kubernetes Service (AKS). You need to ensure that only authorized containers can run in the cluster and that any unauthorized containers are automatically blocked. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply an Azure Policy that restricts container images to only those from approved registries.. Azure Policy for AKS, using the built-in 'Kubernetes cluster containers should only use allowed images' policy, ensures that only images from approved registries can run. Option A is wrong because network policies control traffic between pods, not container authorization. Option C is wrong because Azure AD integration controls authentication, not container image approval. Option D is wrong because Azure RBAC controls who can manage the cluster, not which containers run.

Answer

Implement network policies to restrict communication between pods.

Answer

Enable Azure AD integration for the AKS cluster.

Answer

Configure Azure RBAC roles to limit who can deploy containers.

Question 2

Refer to the exhibit. You are reviewing an Azure Policy definition that is assigned to a subscription containing several virtual machines. After the assignment, users report that they cannot create new VMs. What is the most likely reason?

Accepted Answer

The policy denies creation of VMs that do not use managed disks.. The Azure Policy definition denies the creation of virtual machines that do not use managed disks. The condition in the policy checks whether the 'osDisk.managedDisk' field does not exist (i.e., unmanaged disks are used) and if so, denies the request. Therefore, any attempt to create a VM with unmanaged disks will be denied. Option A is incorrect because the policy does not check VM size; it only evaluates the use of managed disks. Option C is incorrect because the policy denies VMs without managed disks, not those with managed disks. Option D is incorrect because the policy does not require premium SSDs; it only requires managed disks, which can be standard or premium.

Answer

The policy denies creation of VMs with a specific size.

Answer

The policy denies creation of VMs that use managed disks.

Answer

The policy denies creation of VMs that do not use premium SSDs.

Question 3

Your company plans to use Microsoft Defender for Cloud to protect its Azure resources. You need to enable just-in-time (JIT) VM access to reduce the attack surface. Which TWO configurations are required to implement JIT access?

Accepted Answer

Enable JIT VM access in Microsoft Defender for Cloud.. JIT VM access must be enabled in Microsoft Defender for Cloud for the specific VMs. Option D is correct because an Azure Policy can enforce JIT access on VMs, ensuring consistent configuration. Option B is incorrect because Azure Bastion is a separate service for secure remote access and is not a prerequisite for JIT. Option C is incorrect because a Log Analytics workspace is used for collecting logs but is not required for enabling JIT access. Option E is incorrect because JIT access dynamically creates NSG rules to allow inbound traffic only when needed; an NSG that allows all inbound traffic would defeat the purpose of JIT.

Answer

Deploy Azure Bastion for secure RDP/SSH connectivity.

Answer

Configure a Log Analytics workspace to collect JIT logs.

Answer

Create a network security group (NSG) that allows all inbound traffic.

Question 4

Your organization is implementing a defense-in-depth strategy for a multi-tier application hosted on Azure. You need to secure the network layers. Which THREE measures should you implement?

Accepted Answer

Enable Azure DDoS Protection on the virtual network.. The three correct measures are A, C, and E. Option A: Enable Azure DDoS Protection on the virtual network to mitigate volumetric attacks. Option C: Implement Azure Firewall for centralized traffic inspection and filtering between networks. Option E: Use network security groups (NSGs) to control traffic between subnets for micro-segmentation. Option B (Azure Front Door) is incorrect because it is an application delivery service focused on web applications, not a general network security layer for all tiers. Option D (site-to-site VPN gateway) is incorrect because it provides encrypted connectivity, not network security filtering.

Answer

Configure Azure Front Door to protect the application layer.

Answer

Deploy a site-to-site VPN gateway.

Question 5

You are designing a secure infrastructure for an Azure Kubernetes Service (AKS) cluster that will host sensitive workloads. Which TWO configurations should you implement to secure the cluster?

Accepted Answer

Enable Azure AD integration for role-based access control (RBAC).. Enabling Azure AD integration allows you to use Azure AD identities for role-based access control, securing cluster access. Option D is correct because using Azure AD pod identity allows pods to authenticate to Azure resources securely, avoiding hard-coded credentials. Option B is wrong because Azure Monitor for containers provides monitoring and diagnostics, not security controls. Option C is wrong because the HTTP application routing add-on is for ingress routing, not security. Option E is wrong because the cluster autoscaler handles scaling, not security.

Answer

Enable Azure Monitor for containers.

Answer

Enable the HTTP application routing add-on.

Answer

Enable the cluster autoscaler.

Question 6

Your company is planning to use Azure Policy to enforce security compliance across multiple subscriptions. You need to define a set of policies that will be applied to all subscriptions. Which THREE components should you include in your policy assignment?

Accepted Answer

Parameters.. In Azure Policy, a policy assignment consists of three required components: a policy definition (or initiative definition), parameters, and an assignment scope. Option A (Parameters) allows customization of policy effects at assignment time. Option B (Policy definition) is the rule that defines compliance conditions. Option C (Assignment scope) determines where the policy applies, such as a management group, subscription, or resource group. Option D (Initiative definition) is a group of policies; while an initiative can be assigned, the question specifies a single policy assignment, so an initiative is not a component of that assignment. Option E (Remediation task) is an action taken after assignment to fix non-compliant resources, not part of the assignment itself.

Answer

Initiative definition.

Answer

Remediation task.

Question 7

You are the security architect for a company that has a hybrid identity infrastructure with Microsoft Entra ID (formerly Azure AD) and an on-premises Active Directory Domain Services (AD DS) forest. The company is planning to migrate several line-of-business (LOB) applications to Azure Virtual Machines. The applications currently use Windows Integrated Authentication (WIA) and rely on Kerberos delegation. You need to design a solution that allows the Azure VMs to authenticate on-premises users and access on-premises resources using Kerberos constrained delegation (KCD) without exposing on-premises-domain controllers to the internet. The solution must minimize latency and administrative overhead. You have configured Azure ExpressRoute for connectivity between the on-premises network and Azure. What should you do?

Accepted Answer

Deploy domain controllers as Azure VMs in the same virtual network as the application VMs. Configure the application VMs to use these domain controllers for authentication and KCD.. Deploying domain controllers as Azure VMs in the same virtual network as the application VMs allows them to use KCD with low latency, and ExpressRoute ensures secure connectivity without exposing on-premises DCs. Option B is wrong because Azure AD Application Proxy is for publishing on-premises apps, not for authentication delegation; it does not support KCD. Option C is wrong because Azure AD Domain Services provides managed domain services but does not support full KCD and may not meet all application requirements. Option D is wrong because using only ExpressRoute means the VMs would have to communicate with on-premises DCs over the WAN, potentially increasing latency; additionally, this would expose on-premises DCs to the internet if not properly secured.

Answer

Implement Azure AD Application Proxy to publish the applications and use Azure AD for authentication.

Answer

Use Azure AD Domain Services to provide domain join and KCD capabilities for the Azure VMs.

Answer

Configure the application VMs to use the on-premises domain controllers over ExpressRoute for authentication and KCD.

Question 8

Your organization is using Microsoft Defender for Cloud to manage security across multiple Azure subscriptions. You need to ensure that all virtual machines in the subscriptions are monitored by Defender for Cloud and that security alerts are sent to the security operations team. You also need to enforce that any new VMs are automatically onboarded to Defender for Cloud. You have a Log Analytics workspace in the central subscription. What should you do?

Accepted Answer

In Defender for Cloud, enable auto-provisioning for the Log Analytics agent at the management group level and specify the central workspace.. Enabling auto-provisioning of the Log Analytics agent at the management group scope ensures all VMs across subscriptions are monitored and new VMs are automatically onboarded. Option A is wrong because configuring only the workspace does not auto-provision. Option B is wrong because Azure Policy can enforce agent deployment, but auto-provisioning is simpler and more direct. Option D is wrong because enabling Defender for Cloud at the subscription level does not automatically install the agent.

Answer

Enable Defender for Cloud on each subscription and configure email notifications for alerts.

Answer

Assign an Azure Policy that deploys the Log Analytics agent to all VMs.

Answer

Create a Log Analytics workspace in each subscription and configure Defender for Cloud to use that workspace.

Question 9

Your company is deploying a critical application on Azure App Service. You need to secure the application by restricting access to only users within your organization. The application should be accessible from both corporate-managed devices and personal devices that are enrolled in Microsoft Intune. You want to use Microsoft Entra ID for authentication and require that users authenticate using multi-factor authentication (MFA). What should you configure?

Accepted Answer

Configure a Conditional Access policy in Microsoft Entra ID that targets the application, requires MFA, and requires a compliant device.. A Conditional Access policy in Microsoft Entra ID can target the application, require multi-factor authentication (MFA), and require a compliant device (via Intune enrollment). This ensures that only users from the organization on compliant devices can access the app. Option A is wrong because Azure AD B2B is designed for external users, not internal. Option C is wrong because App Service authentication with Microsoft Entra ID alone does not enforce device compliance or MFA; Conditional Access is needed. Option D is wrong because an app registration and user assignment do not enforce MFA or device compliance.

Answer

Use Azure AD B2B collaboration to allow only users from your organization.

Answer

Enable App Service authentication and authorization with Microsoft Entra ID as the identity provider.

Answer

Create an app registration in Microsoft Entra ID and assign users to the enterprise application.

Question 10

Your organization uses Azure SQL Database for a sensitive financial application. You need to implement a defense-in-depth strategy to protect the database. The requirements are: (1) All connections to the database must be encrypted in transit. (2) Only specific Azure services and on-premises IP ranges should be allowed to connect. (3) Database administrators should be able to view the database schema but not the actual data. (4) Auditing must be enabled for all data access. What combination of features should you implement?

Accepted Answer

Enforce TLS 1.2, configure firewall rules, enable Dynamic Data Masking, and enable auditing.. (1) Enforcing TLS 1.2 ensures encryption in transit. (2) Configuring firewall rules restricts access to specific IP ranges and Azure services (using service tags). (3) Dynamic Data Masking hides sensitive data from database administrators while allowing them to view the schema. (4) Enabling auditing logs all data access for compliance. Option A is incorrect because VNet service endpoints and firewall rules provide network isolation but do not enforce TLS encryption or mask data. Option C is incorrect because Azure AD authentication alone does not enforce encryption in transit or mask data. Option D is incorrect because Always Encrypted encrypts data at rest and in use but does not ensure encryption in transit or provide dynamic data masking for viewing schema without seeing data.

Answer

Enable VNet service endpoints and firewall rules, and require Azure AD authentication.

Answer

Configure firewall rules, enable Azure AD authentication, and enable auditing.

Answer

Enable Always Encrypted, configure firewall rules, and enable auditing.

Question 11

Your company has an Azure subscription that contains multiple virtual machines (VMs) running Windows Server. You need to ensure that all VMs are compliant with your organization's security baseline. The security baseline includes specific registry key settings, password policies, and service configurations. You want to continuously monitor and automatically remediate non-compliant VMs. What should you implement?

Accepted Answer

Use Azure Policy with Guest Configuration extension to audit and remediate the VM settings.. Azure Policy with the Guest Configuration extension enables continuous auditing and automatic remediation of in-guest settings such as registry keys, password policies, and service configurations. This integrates natively with Azure Policy for compliance reporting and auto-remediation. Option A is incorrect because Azure Automation State Configuration (DSC) can apply configurations but lacks native integration with Azure Policy for continuous compliance monitoring and automated remediation. Option C is incorrect because Azure Update Manager only handles OS and application updates, not configuration baselines. Option D is incorrect because Microsoft Defender for Cloud provides security recommendations but does not offer granular configuration auditing or automated remediation of specific settings.

Answer

Deploy Azure Automation State Configuration to apply Desired State Configuration (DSC) to the VMs.

Answer

Use Azure Update Manager to ensure VMs are up to date.

Answer

Enable Microsoft Defender for Cloud and review the security recommendations.

Question 12

Your organization is using Microsoft Sentinel to collect security logs from multiple sources, including Azure Activity Logs, Office 365 Audit Logs, and on-premises Windows Event Logs. You need to ensure that security incidents are automatically created when a user from a specific IP address attempts to access a sensitive application. You have already configured the data connectors. What should you create?

Accepted Answer

Create an analytics rule that triggers an incident when access from the IP is detected.. An analytics rule in Microsoft Sentinel defines conditions for generating alerts and incidents based on query results. By creating a rule that queries for access attempts from the specific IP address and setting it to create an incident, you meet the requirement. Option A is wrong because a workbook is for visualization, not automated incident creation. Option B is wrong because a watchlist is a data reference, not an alerting mechanism; it can be used in queries but needs an analytics rule to trigger incidents. Option D is wrong because a playbook automates response but does not create incidents from scratch; it runs after an alert or incident is triggered.

Answer

Create a workbook to visualize the access attempts.

Answer

Create a watchlist containing the IP address and use it in a query.

Answer

Create a playbook that runs when a specific event occurs.

Question 13

Your organization uses Microsoft Sentinel for security operations. You need to design a solution to detect and respond to lateral movement attempts using pass-the-hash attacks. Which TWO data sources should you enable in Microsoft Sentinel to best detect this activity?

Accepted Answer

Windows Security Events via Azure Monitor Agent. We need to detect pass-the-hash attacks, which involve capturing NTLM hashes to authenticate laterally. In Microsoft Sentinel, Windows Security Events via Azure Monitor Agent (Option B) log NTLM authentication events, including Event ID 4624 (successful logon) and others that can reveal pass-the-hash attempts. Microsoft Defender for Identity alerts (Option D) provide behavioral analytics and specific alerts for lateral movement, including pass-the-hash. Option A (Office 365 Audit Logs) is for cloud app activity, not on-premises lateral movement. Option C (DNS query logs) can help detect network anomalies but is not the best direct source for pass-the-hash. Option E (Azure Activity Log) logs Azure resource operations and is irrelevant for on-premises lateral movement.

Answer

Office 365 Audit Logs

Answer

DNS query logs

Answer

Azure Activity Log

Question 14

Your organization is migrating from on-premises Active Directory to Microsoft Entra ID. You need to design a solution for hybrid identity that supports seamless SSO for legacy applications that require Kerberos authentication. Which THREE components should you include in your design?

Accepted Answer

Deploy Azure AD Application Proxy to publish legacy apps. Option A (Azure AD Application Proxy) is required to publish on-prem legacy applications that use Integrated Windows Authentication (IWA). It uses Kerberos constrained delegation (KCD) to provide SSO for legacy apps that require Kerberos. Option B (register as Enterprise Applications) is necessary to integrate the apps with Microsoft Entra ID and manage access. Option D (Microsoft Entra Connect with Seamless SSO enabled) provides the seamless sign-on experience by using the user's domain Kerberos ticket when authenticating to Entra ID. Option E (Password Hash Sync with SSPR integration) is not required for this scenario; Seamless SSO works with either PHS or Pass-through Authentication, and SSPR integration is unrelated to Kerberos SSO for legacy apps. Option C (AD FS) is optional and not required when using Seamless SSO and Application Proxy.

Answer

Active Directory Federation Services (AD FS) deployed on-premises

Answer

Password Hash Sync (PHS) with Self-Service Password Reset (SSPR) integration

Question 15

Your company uses Microsoft Intune to manage Windows 10 devices. You need to design a security baseline that ensures devices meet the organization's security requirements, including BitLocker encryption, Windows Defender Firewall rules, and Microsoft Defender for Endpoint settings. Which TWO Intune features should you use to apply these configurations?

Accepted Answer

Endpoint security policies for Antivirus, Firewall, and Disk Encryption. (Endpoint security policies) allows granular configuration of Antivirus, Firewall, and Disk Encryption settings, directly addressing the requirements for BitLocker, Windows Defender Firewall, and Microsoft Defender for Endpoint. Option E (Security Baselines for Windows 10) provides pre-configured security baselines that include these same features, ensuring devices meet organizational security standards. Option A (Device enrollment restrictions) controls device enrollment but does not apply configurations. Option C (Compliance policies) evaluates compliance but does not apply settings. Option D (Custom configuration profiles) could be used but is not as comprehensive or purpose-built as the two correct options.

Answer

Device enrollment restrictions

Answer

Compliance policies for Windows 10

Answer

Custom configuration profiles using OMA-URI