SC-100 Design security solutions for infrastructure Practice Test 15 — 15 Questions

Question 1

Your company is planning to use Azure Policy to enforce security compliance across multiple subscriptions. You need to define a set of policies that will be applied to all subscriptions. Which THREE components should you include in your policy assignment?

Accepted Answer

Parameters.. Option A is correct because policy definitions are the rules that enforce compliance. Option C is correct because assignment scope defines where the policy applies (e.g., management group, subscription). Option D is correct because parameters allow customization of policy definitions at assignment time. Option B is wrong because initiative definitions are groups of policies, but the question asks for components of a single policy assignment; an initiative is a separate artifact. Option E is wrong because remediation tasks are actions taken after assignment, not part of the assignment itself.

Answer

Initiative definition.

Answer

Remediation task.

Question 2

You are the security architect for a company that has a hybrid identity infrastructure with Microsoft Entra ID (formerly Azure AD) and an on-premises Active Directory Domain Services (AD DS) forest. The company is planning to migrate several line-of-business (LOB) applications to Azure Virtual Machines. The applications currently use Windows Integrated Authentication (WIA) and rely on Kerberos delegation. You need to design a solution that allows the Azure VMs to authenticate on-premises users and access on-premises resources using Kerberos constrained delegation (KCD) without exposing on-premises-domain controllers to the internet. The solution must minimize latency and administrative overhead. You have configured Azure ExpressRoute for connectivity between the on-premises network and Azure. What should you do?

Accepted Answer

Deploy domain controllers as Azure VMs in the same virtual network as the application VMs. Configure the application VMs to use these domain controllers for authentication and KCD.. Option A is correct because deploying domain controllers as Azure VMs in the same virtual network as the application VMs allows them to use KCD with low latency, and ExpressRoute ensures secure connectivity without exposing on-premises DCs. Option B is wrong because Azure AD Domain Services provides managed domain services but does not support full KCD and may not meet all application requirements. Option C is wrong because using only ExpressRoute means the VMs would have to communicate with on-premises DCs over the WAN, potentially increasing latency. Option D is wrong because Azure AD Application Proxy is for publishing on-premises apps, not for authentication delegation.

Answer

Implement Azure AD Application Proxy to publish the applications and use Azure AD for authentication.

Answer

Use Azure AD Domain Services to provide domain join and KCD capabilities for the Azure VMs.

Answer

Configure the application VMs to use the on-premises domain controllers over ExpressRoute for authentication and KCD.

Question 3

Your organization is using Microsoft Defender for Cloud to manage security across multiple Azure subscriptions. You need to ensure that all virtual machines in the subscriptions are monitored by Defender for Cloud and that security alerts are sent to the security operations team. You also need to enforce that any new VMs are automatically onboarded to Defender for Cloud. You have a Log Analytics workspace in the central subscription. What should you do?

Accepted Answer

In Defender for Cloud, enable auto-provisioning for the Log Analytics agent at the management group level and specify the central workspace.. Option C is correct because enabling auto-provisioning of the Log Analytics agent at the management group scope ensures all VMs across subscriptions are monitored and new VMs are automatically onboarded. Option A is wrong because configuring only the workspace does not auto-provision. Option B is wrong because Azure Policy can enforce agent deployment, but auto-provisioning is simpler and more direct. Option D is wrong because enabling Defender for Cloud at the subscription level does not automatically install the agent.

Answer

Enable Defender for Cloud on each subscription and configure email notifications for alerts.

Answer

Assign an Azure Policy that deploys the Log Analytics agent to all VMs.

Answer

Create a Log Analytics workspace in each subscription and configure Defender for Cloud to use that workspace.

Question 4

Your company is deploying a critical application on Azure App Service. You need to secure the application by restricting access to only users within your organization. The application should be accessible from both corporate-managed devices and personal devices that are enrolled in Microsoft Intune. You want to use Microsoft Entra ID for authentication and require that users authenticate using multi-factor authentication (MFA). What should you configure?

Accepted Answer

Configure a Conditional Access policy in Microsoft Entra ID that targets the application, requires MFA, and requires a compliant device.. Option A is correct because a Conditional Access policy can require MFA and compliant devices (via Intune) for access to the App Service app. Option B is wrong because App Service authentication alone does not enforce device compliance. Option C is wrong because an app registration alone does not enforce MFA. Option D is wrong because Azure AD B2B is for external users, not internal.

Answer

Use Azure AD B2B collaboration to allow only users from your organization.

Answer

Enable App Service authentication and authorization with Microsoft Entra ID as the identity provider.

Answer

Create an app registration in Microsoft Entra ID and assign users to the enterprise application.

Question 5

Your organization uses Azure SQL Database for a sensitive financial application. You need to implement a defense-in-depth strategy to protect the database. The requirements are: (1) All connections to the database must be encrypted in transit. (2) Only specific Azure services and on-premises IP ranges should be allowed to connect. (3) Database administrators should be able to view the database schema but not the actual data. (4) Auditing must be enabled for all data access. What combination of features should you implement?

Accepted Answer

Enforce TLS 1.2, configure firewall rules, enable Dynamic Data Masking, and enable auditing.. Option D is correct because: (1) Enforce TLS 1.2 ensures encryption in transit. (2) Firewall rules restrict access by IP. (3) Dynamic Data Masking hides sensitive data from admins. (4) Auditing logs data access. Option A is wrong because Always Encrypted encrypts data at rest and in use but does not restrict network access. Option B is wrong because VNet service endpoints provide network isolation but do not enforce TLS. Option C is wrong because Azure AD authentication does not restrict network access or mask data.

Answer

Enable VNet service endpoints and firewall rules, and require Azure AD authentication.

Answer

Configure firewall rules, enable Azure AD authentication, and enable auditing.

Answer

Enable Always Encrypted, configure firewall rules, and enable auditing.

Question 6

Your company has an Azure subscription that contains multiple virtual machines (VMs) running Windows Server. You need to ensure that all VMs are compliant with your organization's security baseline. The security baseline includes specific registry key settings, password policies, and service configurations. You want to continuously monitor and automatically remediate non-compliant VMs. What should you implement?

Accepted Answer

Use Azure Policy with Guest Configuration extension to audit and remediate the VM settings.. Option A is correct because Azure Policy with Guest Configuration extension allows you to audit and remediate settings inside VMs, including registry keys and services. Option B is wrong because Azure Automation State Configuration is for DSC, but it requires more manual setup and does not integrate natively with Azure Policy for compliance. Option C is wrong because Microsoft Defender for Cloud provides security recommendations but not granular configuration remediation. Option D is wrong because Azure Update Manager focuses on patching, not configuration.

Answer

Deploy Azure Automation State Configuration to apply Desired State Configuration (DSC) to the VMs.

Answer

Use Azure Update Manager to ensure VMs are up to date.

Answer

Enable Microsoft Defender for Cloud and review the security recommendations.

Question 7

Your organization is using Microsoft Sentinel to collect security logs from multiple sources, including Azure Activity Logs, Office 365 Audit Logs, and on-premises Windows Event Logs. You need to ensure that security incidents are automatically created when a user from a specific IP address attempts to access a sensitive application. You have already configured the data connectors. What should you create?

Accepted Answer

Create an analytics rule that triggers an incident when access from the IP is detected.. Option D is correct because an analytics rule in Microsoft Sentinel can be configured to alert on specific activities (e.g., access from a certain IP). Option A is wrong because a watchlist is a data source, not an alerting mechanism. Option B is wrong because a playbook is a response action, not an alert trigger. Option C is wrong because a workbook is a visualization tool.

Answer

Create a workbook to visualize the access attempts.

Answer

Create a watchlist containing the IP address and use it in a query.

Answer

Create a playbook that runs when a specific event occurs.

Question 8

Your company has a Microsoft 365 E5 subscription and uses Microsoft Defender for Office 365. You need to protect users from phishing attacks that use malicious links in email messages. The solution should allow users to report suspicious emails to the security team for analysis. You also want to automatically block repeated phishing attempts from the same sender. What should you configure?

Accepted Answer

Configure Safe Links policies and enable the Report Message add-in for user reporting.. Option B is correct because Safe Links protects users from clicking malicious links in real time, and the user reporting add-in allows reporting. Attack simulation training helps educate users but is not the primary protection mechanism. Option A is wrong because only the reporting add-in does not protect against links. Option C is wrong because Safe Attachments protects attachments, not links. Option D is wrong because anti-spam policies are for spam, not phishing links.

Answer

Configure anti-spam policies and enable the Report Message add-in.

Answer

Configure Safe Attachments policies and enable the Report Message add-in.

Answer

Enable the Report Message add-in for Outlook and configure a mailbox for submissions.

Question 9

Your organization uses Microsoft Sentinel for security operations. You need to design a solution to detect and respond to lateral movement attempts using pass-the-hash attacks. Which TWO data sources should you enable in Microsoft Sentinel to best detect this activity?

Accepted Answer

Windows Security Events via Azure Monitor Agent. Option A (Windows Security Events) logs NTLM authentication events that can reveal pass-the-hash attempts. Option D (Microsoft Defender for Identity) provides advanced behavioral analytics to detect lateral movement. Option B (Azure Activity) is for Azure resource operations, not on-premises lateral movement. Option C (Office 365) is for cloud app activity. Option E (DNS) helps with network detection but is not the best for pass-the-hash.

Answer

Office 365 Audit Logs

Answer

DNS query logs

Answer

Azure Activity Log

Question 10

Your company is deploying Microsoft Sentinel in a government agency that requires strict data residency. You need to ensure that all Sentinel data is stored within the United States. Which THREE actions must you take to meet this requirement?

Accepted Answer

Disable cross-region replication in the Log Analytics workspace settings.. Option A (Select workspace region) is critical because data is stored in the region where the Log Analytics workspace is created. Option B (Enable customer-managed keys) is required for compliance in many government scenarios. Option D (Disable cross-region data replication) ensures data does not replicate outside the US. Option C (Enable data export) would send data elsewhere. Option E (Use Azure Policy) can enforce, but it's not a direct data residency action.

Answer

Configure data export to a storage account in a different region for redundancy.

Answer

Use Azure Policy to audit workspace region for compliance.

Question 11

Your organization is migrating from on-premises Active Directory to Microsoft Entra ID. You need to design a solution for hybrid identity that supports seamless SSO for legacy applications that require Kerberos authentication. Which THREE components should you include in your design?

Accepted Answer

Register legacy applications as Enterprise Applications in Microsoft Entra ID. Option A (Microsoft Entra Connect) enables synchronization and seamless SSO. Option C (Password hash sync) is required for seamless SSO. Option D (Enterprise App registration) allows legacy apps to use Microsoft Entra ID for authentication. Option B (AD FS) is optional and not required; Option E (Azure AD Application Proxy) is for remote access, not Kerberos SSO.

Answer

Deploy Azure AD Application Proxy to publish legacy apps

Answer

Active Directory Federation Services (AD FS) deployed on-premises

Question 12

Your company uses Microsoft Intune to manage Windows 10 devices. You need to design a security baseline that ensures devices meet the organization's security requirements, including BitLocker encryption, Windows Defender Firewall rules, and Microsoft Defender for Endpoint settings. Which TWO Intune features should you use to apply these configurations?

Accepted Answer

Endpoint security policies for Antivirus, Firewall, and Disk Encryption. Option A (Security Baselines) provides pre-configured settings for security features. Option D (Endpoint security policies) allows granular configuration for antivirus, firewall, and BitLocker. Option B (Compliance policies) enforce but not configure; Option C (Configuration profiles) can do settings but not as comprehensive; Option E (Device enrollment restrictions) are for enrollment control.

Answer

Device enrollment restrictions

Answer

Compliance policies for Windows 10

Answer

Custom configuration profiles using OMA-URI

Question 13

Your organization is adopting a Zero Trust security model. You need to design a solution for secure remote access to on-premises applications that eliminates VPNs. Which TWO Microsoft technologies should you use?

Accepted Answer

Microsoft Entra Application Proxy. Option C (Microsoft Entra Application Proxy) provides secure remote access to on-premises apps without VPN. Option E (Microsoft Defender for Cloud Apps) provides conditional access and session control. Option A (Azure VPN Gateway) is VPN; Option B (Azure Bastion) is for RDP/SSH to VMs; Option D (Microsoft Intune) is for device management.

Answer

Azure Bastion

Answer

Microsoft Intune

Answer

Azure VPN Gateway

Question 14

Your organization uses Azure Kubernetes Service (AKS) for containerized workloads. You need to design a security solution that includes network segmentation, threat detection, and secret management. Which THREE Azure services should you include?

Accepted Answer

Azure Key Vault with CSI driver for secrets store. Option A (Azure Policy for AKS) enforces network policies and compliance. Option C (Azure Security Center for Kubernetes, now part of Defender for Cloud) provides threat detection. Option D (Azure Key Vault) stores secrets. Option B (Azure Firewall) is for perimeter, not AKS-specific; Option E (Azure Service Bus) is messaging.

Answer

Azure Service Bus

Answer

Azure Firewall Premium

Question 15

You are a security architect at a global manufacturing company. The company uses a hybrid infrastructure with on-premises Active Directory and Azure. They have recently deployed Microsoft Sentinel as their SIEM. The security team wants to detect and investigate ransomware attacks that spread via SMB. The CISO has requested a solution that can automatically block malicious IPs at the network level and provide forensic evidence. You need to design a solution that meets these requirements with minimal manual intervention. What should you include in your design?

Accepted Answer

Integrate Microsoft Defender for Identity with Sentinel. Create a playbook that automatically adds malicious IPs to a custom Azure Firewall policy, and use Sentinel incidents for investigation.. Option C uses Microsoft Defender for Identity to detect SMB-based attacks and Azure Firewall to block IPs via playbooks. Option A uses Azure Firewall alone without detection; Option B uses NSG but cannot block based on real-time threat intel; Option D uses VPC (AWS) which is not applicable.

Answer

Deploy Azure Firewall with threat intelligence-based filtering enabled. Use Sentinel to generate alerts when SMB traffic is detected, and manually block IPs.

Answer

Use Microsoft Defender for Cloud to detect ransomware and deploy a third-party firewall in VPC. Configure Sentinel to send alerts to the firewall API.

Answer

Enable network security groups (NSGs) on all subnets. Use Sentinel to detect SMB anomalies and apply NSG rules via Azure Policy.