SC-100 Design security solutions for infrastructure Practice Test 15 — 15 Questions

Question 1

Which TWO of the following are valid methods to secure Azure Kubernetes Service (AKS) workloads?

Accepted Answer

Integrate Azure AD for cluster authentication. Option A is correct because integrating Microsoft Entra ID (Azure AD) with AKS enables cluster authentication and authorization via Azure RBAC, allowing you to control who can access the Kubernetes API server and manage workloads using identity-based controls rather than static credentials. Option E is correct because Azure Policy for AKS uses the Gatekeeper admission controller (Open Policy Agent) to enforce policies on pods and cluster resources at admission time, preventing non-compliant workloads from being deployed and thus hardening the workload configuration. Option B is not the intended answer because Network Security Groups apply at the subnet/NIC level for network traffic filtering, not specifically for securing AKS workloads at the pod or admission level, and pod-level security typically uses Kubernetes Network Policies. Option C is not correct in this context because Azure Firewall provides network perimeter protection and egress filtering but does not directly secure AKS workloads themselves. Option D is not correct because Azure Front Door is a global HTTP/HTTPS load balancer and WAF for web applications, not a mechanism for securing AKS workloads internally.

Answer

Apply Network Security Groups to pod subnets

Answer

Deploy Azure Firewall in front of the AKS cluster

Answer

Use Azure Front Door to protect API endpoints

Question 2

Which THREE of the following are best practices for designing a secure hybrid network architecture with Azure?

Accepted Answer

Use Azure Bastion for secure VM access without public IPs. Option A is correct because Azure Bastion provides RDP/SSH connectivity to VMs directly through the Azure portal over TLS, eliminating the need to expose public IP addresses or open inbound management ports (3389/22) on the VMs, which removes a major attack surface in a hybrid design. Option C is correct because ExpressRoute gives private, dedicated connectivity between on-premises and Azure that bypasses the public internet, and pairing it with Azure Firewall provides centralized, stateful Layer 3–7 traffic inspection and filtering across the hybrid boundary. Option E is correct because forced tunneling routes all internet-bound traffic from Azure subnets back through on-premises (via UDRs with a next hop of the VPN/ExpressRoute gateway), enabling on-premises firewalls, proxies, and DLP to inspect and control that traffic consistently. Option B is wrong because opening all ports to a management subnet violates least-privilege and network segmentation principles, dramatically expanding the attack surface. Option D is wrong because a single VPN gateway is a regional resource and a single point of failure; multi-region designs should use gateways per region (or zone-redundant/active-active configurations) for resiliency and latency.

Answer

Open all ports to a management subnet for ease of administration

Answer

Use a single VPN gateway for all regions

Question 3

Which TWO of the following are features of Azure DDoS Protection?

Accepted Answer

Cost protection for scaled resources during an attack. Option A is correct because Azure DDoS Protection includes DDoS cost protection, which provides service credits for resource costs incurred from scale-out during a documented DDoS attack, helping avoid unexpected charges. Option E is correct because Azure DDoS Protection uses adaptive tuning and automatic mitigation, learning normal traffic patterns and applying tailored mitigation policies to protect Azure resources from volumetric, protocol, and application-layer attacks. Option B is not a feature of Azure DDoS Protection itself; WAF capabilities are provided by Azure Web Application Firewall, typically through Application Gateway or Front Door. Option C is unrelated, as site-to-site VPN connectivity is provided by Azure VPN Gateway. Option D is also unrelated, since SSL termination and offloading are handled by services such as Application Gateway or Azure Front Door, not by Azure DDoS Protection.

Answer

Web application firewall (WAF) capabilities

Answer

Site-to-site VPN connectivity

Answer

SSL termination and offloading

Question 4

Refer to the exhibit. A company applies this Azure Policy to their subscription. An administrator tries to create a VM with a public IP address. What will happen?

Accepted Answer

The VM creation will be denied. Azure Policy with a 'Deny' effect blocks the non-compliant resource creation request at the Azure Resource Manager layer, so the VM creation with a public IP will be denied. The policy is evaluated during the ARM template/resource deployment, and if the resource violates the rule, the request fails with a policy violation error. This is the intended behavior of a Deny-effect policy assignment.

Answer

The public IP will be automatically removed

Answer

The VM will be created, but an alert will be generated

Answer

The policy will only apply to VMs in a specific resource group

Question 5

Your organization is deploying Microsoft Defender for Cloud to secure a hybrid environment with workloads in Azure and on-premises. You need to ensure that all servers are covered by Defender for Cloud's plans. Which two actions should you take?

Accepted Answer

Install the Azure Connected Machine agent (Azure Arc) on on-premises servers.. The correct actions are A and C. Installing the Azure Connected Machine agent (Azure Arc) on on-premises servers is required to project non-Azure machines into Azure so Defender for Cloud can see and manage them, and enabling the Defender for Cloud plans (e.g., Defender for Servers) on the Azure subscription activates the actual protection plans that cover those servers. Option B is insufficient because foundational CSPM only provides posture assessment and does not enable workload protection plans such as Defender for Servers. Option D is not sufficient by itself because the Azure Monitor Agent collects monitoring data but does not onboard on-premises servers into Defender for Cloud without Azure Arc and the relevant Defender plan.

Answer

Enable only the foundational cloud security posture management (CSPM) on the subscription.

Answer

Deploy the Azure Monitor Agent to all on-premises servers.

Question 6

You are designing a secure access solution for an Azure Kubernetes Service (AKS) cluster that hosts a critical application. You need to ensure that only authorized users can access the Kubernetes API server. Which authentication method should you use?

Accepted Answer

Integrate AKS with Microsoft Entra ID for authentication.. The correct option is D: integrate AKS with Microsoft Entra ID for authentication, because this scenario requires authenticating human users who access the Kubernetes API server, and Entra ID integration provides centralized identity-based authentication with conditional access, MFA, and group-based access. AKS supports Entra ID integration so that kubectl and other clients obtain Entra ID tokens that the API server validates, ensuring only authorized users can authenticate. Option A is not suitable because service account tokens are for workloads and automation inside the cluster, not for authenticating external users. Option B is incorrect because managed identities are Azure resource identities for services, not per-user Kubernetes API authentication. Option C is incorrect because Azure RBAC for Kubernetes authorization controls what an already-authenticated principal can do, not how users are authenticated.

Answer

Use Kubernetes service account tokens.

Answer

Use AKS managed identities for each user.

Answer

Use Azure RBAC for Kubernetes authorization.

Question 7

Your organization uses Microsoft Defender for Identity (MDI) to protect on-premises Active Directory. You need to integrate MDI with Microsoft Sentinel to centralize detection and response. What is the required configuration?

Accepted Answer

Enable the Microsoft Defender for Identity data connector in Microsoft Sentinel.. The correct option is C: enabling the Microsoft Defender for Identity data connector in Microsoft Sentinel. MDI integrates with Sentinel through a built-in data connector that streams MDI alerts and related identity events into the Sentinel workspace, allowing centralized detection and response without extra infrastructure. Option A is unnecessary because the MDI sensor is deployed on domain controllers or AD FS servers, not Azure VMs, and the sensor does not send data directly to Sentinel. Option B is incorrect because Entra ID Protection covers cloud identity risk, not on-premises AD signals from MDI. Option D is incorrect because MDI does not natively forward to Syslog for Sentinel ingestion; the supported path is the MDI data connector.

Answer

Deploy the MDI sensor on an Azure VM to send data to Sentinel.

Answer

Integrate Microsoft Entra ID Protection with Sentinel instead.

Answer

Configure MDI to forward logs to a Syslog server, then use the Syslog connector in Sentinel.

Question 8

Your company is planning to use Microsoft Intune for mobile device management (MDM). You need to ensure that devices are compliant before accessing corporate resources. Which TWO components should you configure?

Accepted Answer

Conditional Access policies in Microsoft Entra ID.. Compliance policies (D) are the correct component because they define the rules a device must meet—such as requiring a PIN, encryption, or a minimum OS version—and Intune uses them to mark devices as compliant or non-compliant, which is the prerequisite for gating access to corporate resources. Conditional Access policies in Microsoft Entra ID (C) are also correct because they enforce the actual access decision, using signals like device compliance status to grant, block, or require additional controls (for example, MFA) before a device can reach corporate resources. Together, compliance policies evaluate the device and Conditional Access enforces that evaluation at sign-in. Device configuration policies (A) only push settings to devices but do not by themselves determine compliance, enrollment restrictions (B) merely limit which devices or platforms can enroll, and app protection policies (E) protect app-level data on mobile apps without establishing device compliance for resource access.

Answer

Device configuration policies.

Answer

Enrollment restrictions.

Answer

App protection policies.

Question 9

You are a security architect for a software development company. The company uses GitHub for source control and Azure DevOps for CI/CD. They have a large number of repositories and want to ensure that secrets (e.g., API keys, connection strings) are never committed to code. They also want to scan pull requests for secrets before merging. The company has Microsoft Defender for Cloud and Microsoft Purview available. You need to design a solution that prevents secret leaks. What should you use?

Accepted Answer

Enable GitHub secret scanning for all repositories. Configure push protection to block commits containing secrets. Use custom patterns to scan for company-specific secrets.. GitHub secret scanning can scan repositories for known secret patterns and supports custom patterns for company-specific secrets. Push protection blocks commits containing secrets before they are pushed. Option A is incorrect because Microsoft Defender for Cloud does not provide built-in secret scanning for GitHub repositories; GitHub secret scanning is a separate feature. Option B is incorrect because Azure Key Vault stores secrets but does not scan code for secrets. Option C is incorrect because Microsoft Purview Information Protection is for data classification and labeling, not for secret scanning in source code.

Answer

Enable Microsoft Defender for Cloud's 'Secrets scanning' feature for GitHub repositories.

Answer

Use Azure Key Vault to store secrets and enforce policies that require developers to use Key Vault references.

Answer

Use Microsoft Purview Information Protection to scan repositories and classify secrets.

Question 10

You are a security architect for a retail company that uses Microsoft 365 and Azure. The company has a large number of remote employees who use both company-managed and personal devices. You need to design a solution to ensure that only compliant devices can access corporate email (Exchange Online) and files (SharePoint Online). The company has Microsoft Intune and Microsoft Entra ID P1 licenses. You need to implement device-based conditional access. What should you do?

Accepted Answer

Enroll devices in Intune, create compliance policies, and configure Conditional Access policies in Entra ID to require compliant devices.. Intune compliance policies define device health requirements, and Conditional Access policies enforce access based on compliance. Option A is wrong because app protection policies are for mobile application management (MAM) without device enrollment, but the requirement is device-based. Option C is wrong because device enrollment itself does not enforce compliance. Option D is wrong because Configuration Manager is for on-premises management, not cloud devices.

Answer

Deploy app protection policies (MAM) in Intune to protect data in Exchange Online and SharePoint Online.

Answer

Require all devices to be enrolled in Intune using automatic enrollment via Group Policy.

Answer

Use Microsoft Endpoint Configuration Manager to manage device compliance and integrate with Entra ID.

Question 11

Your organization plans to use Microsoft Defender for Cloud to protect hybrid workloads across Azure and on-premises servers. You need to ensure that security policies are consistently applied and that compliance status is monitored centrally. What should you configure?

Accepted Answer

Create Azure Policy initiatives and assign them to management groups and subscriptions.. The correct option is B: Create Azure Policy initiatives and assign them to management groups and subscriptions. Azure Policy initiatives (policy sets) are the mechanism Microsoft Defender for Cloud uses to evaluate and enforce security controls consistently across Azure and hybrid/Arc-connected servers, and assigning them at management-group scope cascades the same definitions to all child subscriptions so compliance is monitored centrally in Defender for Cloud's regulatory compliance dashboard. Options A and C do not fit because manually applying Azure Security Benchmark recommendations or configuring policies only inside Defender for Cloud lacks the scalable, centrally assigned initiative/scope model needed for consistent enforcement. Option D is wrong because Azure Blueprints is a deprecated orchestration service for packaging role assignments, policies, and templates at subscription scope, not the recommended way to assign policy initiatives to management groups.

Answer

Implement Azure Security Benchmark recommendations manually.

Answer

Configure security policies directly in Microsoft Defender for Cloud.

Answer

Deploy Azure Blueprints to assign policies to management groups.

Question 12

A company uses Microsoft Sentinel for SIEM and SOAR. You need to design a solution to detect and automatically respond to ransomware attacks involving mass file encryption on Windows servers. The response must include isolating the compromised server from the network, creating a backup of affected files, and resetting the user account's password. Which automation approach minimizes manual intervention?

Accepted Answer

Set up an automation rule that runs a playbook to isolate the VM, trigger a backup, and reset the user password.. Microsoft Sentinel automation rules can automatically trigger a Logic Apps playbook in response to an incident, and that playbook can orchestrate the full response chain: isolating the compromised VM (e.g., via network security group changes or Microsoft Defender for Endpoint isolation), initiating a backup/snapshot of affected files, and resetting the user's password through Microsoft Graph or Microsoft Entra ID—all with minimal manual intervention. Option A is incomplete because it only creates a snapshot and emails the team, providing no isolation or password reset. Option B only isolates the VM and does not address backup or password reset, and an alert rule alone is not the full SOAR orchestration. Option D is manual and therefore does not minimize intervention.

Answer

Use a Logic Apps playbook to create a VM snapshot and send an email to the security team.

Answer

Create an alert rule that triggers an Azure Automation runbook to isolate the VM.

Answer

Configure a manual incident response plan that includes password reset.

Question 13

Your company is deploying Azure Kubernetes Service (AKS) and needs to secure container workloads. You must ensure that only approved container images from a trusted Azure Container Registry (ACR) can be deployed. What should you implement?

Accepted Answer

Apply an Azure Policy initiative to only allow images from a specific ACR.. Azure Policy for AKS can enforce admission control on the cluster so that only container images originating from an approved Azure Container Registry are admitted, which directly satisfies the requirement to restrict deployments to trusted ACR images. The built-in initiative/policy (for example, 'Kubernetes cluster containers should only use allowed images') evaluates image references against an allowlist of registry prefixes and denies non-compliant pods. Microsoft Entra ID integration (A) handles authentication and RBAC for cluster access, not image provenance. Key Vault (C) stores secrets such as registry credentials but does not restrict which images can be deployed. Network policies (D) control pod-level traffic flows and cannot enforce image registry allowlisting.

Answer

Enable Azure AD integration for AKS.

Answer

Use Azure Key Vault to store container image credentials.

Answer

Configure network policies in AKS to restrict egress traffic.

Question 14

You are designing a secure access solution for a manufacturing company's IoT devices that send telemetry to Azure IoT Hub. The devices run on a private network with no internet access except through a firewall. You need to ensure that device-to-cloud communication is authenticated and encrypted, and that device credentials are rotated regularly. What should you include in the design?

Accepted Answer

Use X.509 certificates with Azure Device Provisioning Service (DPS) for automatic enrollment and certificate rotation.. X.509 certificates provide mutual TLS authentication and encryption for device-to-cloud traffic to IoT Hub, and Azure Device Provisioning Service (DPS) supports automatic enrollment plus certificate rotation workflows (for example, via enrollment groups and rolling certificate updates), which directly meets the requirement for regularly rotated device credentials. Azure Firewall (A) is a network security control and does not authenticate or encrypt IoT device application traffic end-to-end. SAS tokens (C) can authenticate devices but are symmetric shared secrets that are harder to rotate safely at scale and do not provide the same certificate-based identity lifecycle as DPS-managed X.509. Managed identities (D) are for Azure resources accessing Azure services and cannot be assigned to external IoT devices.

Answer

Configure Azure Firewall to authenticate and encrypt device traffic.

Answer

Use shared access signature (SAS) tokens with a central key management system.

Answer

Assign managed identities to each IoT device.

Question 15

A multinational corporation uses Microsoft Entra ID for identity and Microsoft Defender for Cloud Apps for SaaS app governance. The security team wants to deploy a conditional access policy that blocks access from untrusted locations for all cloud apps except Microsoft 365, which should only be blocked if the device is not compliant. How should you configure the policy?

Accepted Answer

Create two conditional access policies: one for all cloud apps except Microsoft 365 blocking untrusted locations, and one for Microsoft 365 requiring compliant device.. Option B is correct because Conditional Access policies apply to either all cloud apps or specific apps, and Microsoft 365 cannot be excluded from one policy while having different conditions applied within the same policy. The scenario requires two separate policies: one targeting all cloud apps with Microsoft 365 excluded that blocks untrusted locations, and a second targeting Microsoft 365 that requires a compliant device. Option A is wrong because Defender for Cloud Apps session policies monitor or control sessions but do not block sign-ins from untrusted locations. Option C is wrong because a single policy cannot apply a compliant-device requirement only to Microsoft 365 while including all other cloud apps with different conditions. Option D is wrong because it blocks Microsoft 365 from untrusted locations unconditionally, ignoring the compliant-device exception.

Answer

Use a session policy in Defender for Cloud Apps to monitor non-compliant devices.

Answer

Create one conditional access policy that includes all cloud apps and requires compliant device for Microsoft 365 only.

Answer

Configure a conditional access policy that blocks access from untrusted locations for all apps.