SC-100 Design security solutions for infrastructure Practice Test 15 — 15 Questions

Question 1

Your organization is adopting a Zero Trust security model. You need to design a solution for secure remote access to on-premises applications that eliminates VPNs. Which TWO Microsoft technologies should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra Application Proxy. (Microsoft Entra Application Proxy) provides secure remote access to on-premises apps without requiring a VPN, making it a key Zero Trust technology. Option D (Microsoft Defender for Cloud Apps) is a Cloud Access Security Broker (CASB) that enables conditional access and session control, complementing the proxy by enforcing security policies. Option A (Azure Bastion) is used for secure RDP/SSH access to Azure VMs, not for general on-premises applications. Option B (Microsoft Intune) focuses on mobile device and application management, not remote application access. Option E (Azure VPN Gateway) is a traditional VPN solution, which the question explicitly aims to eliminate.

Answer

Azure Bastion

Answer

Microsoft Intune

Answer

Azure VPN Gateway

Question 2

Your organization uses Azure Kubernetes Service (AKS) for containerized workloads. You need to design a security solution that includes network segmentation, threat detection, and secret management. Which THREE Azure services should you include?

Accepted Answer

Azure Key Vault with CSI driver for secrets store. Azure Key Vault with CSI driver, which provides secret management for AKS pods. Option C is Azure Policy for Kubernetes, which enforces network policies and compliance via Azure Policy add-on. Option D is Microsoft Defender for Cloud, which provides threat detection for Kubernetes clusters. Option B (Azure Service Bus) is a messaging service and not relevant. Option E (Azure Firewall Premium) is a perimeter firewall, not specific to AKS.

Answer

Azure Service Bus

Answer

Azure Firewall Premium

Question 3

You are a security architect at a global manufacturing company. The company uses a hybrid infrastructure with on-premises Active Directory and Azure. They have recently deployed Microsoft Sentinel as their SIEM. The security team wants to detect and investigate ransomware attacks that spread via SMB. The CISO has requested a solution that can automatically block malicious IPs at the network level and provide forensic evidence. You need to design a solution that meets these requirements with minimal manual intervention. What should you include in your design?

Accepted Answer

Integrate Microsoft Defender for Identity with Sentinel. Create a playbook that automatically adds malicious IPs to a custom Azure Firewall policy, and use Sentinel incidents for investigation.. Integrates Microsoft Defender for Identity to detect SMB-based attacks, then uses a Sentinel playbook to automatically add malicious IPs to an Azure Firewall policy, providing automated network-level blocking and forensic evidence. Option A uses Azure Firewall with threat intelligence, but manual blocking violates minimal intervention. Option B relies on Microsoft Defender for Cloud and a third-party firewall in a VPC (AWS term), which is outside the Azure ecosystem and adds complexity. Option D uses NSGs, which are stateful but cannot dynamically block based on real-time threat intel as effectively as Azure Firewall, and Azure Policy applies rules at deployment, not in real-time.

Answer

Deploy Azure Firewall with threat intelligence-based filtering enabled. Use Sentinel to generate alerts when SMB traffic is detected, and manually block IPs.

Answer

Use Microsoft Defender for Cloud to detect ransomware and deploy a third-party firewall in VPC. Configure Sentinel to send alerts to the firewall API.

Answer

Enable network security groups (NSGs) on all subnets. Use Sentinel to detect SMB anomalies and apply NSG rules via Azure Policy.

Question 4

You are designing a security solution for a financial services company that uses Microsoft 365 E5 and Azure. They have 10,000 users and 500 servers. They need to implement a Zero Trust network strategy that includes microsegmentation, identity-based access, and continuous monitoring. The solution must work across on-premises and cloud workloads. They also require that all access to critical servers is logged and audited. What should you include in your design?

Accepted Answer

Use Azure Virtual Network Manager (AVNM) for network groups and security admin rules. Implement Microsoft Entra ID Conditional Access with device compliance. Use Microsoft Defender for Cloud for continuous monitoring and Azure Policy for audit.. Azure Virtual Network Manager (AVNM) provides network groups and security admin rules for microsegmentation across on-premises and cloud workloads. Microsoft Entra ID Conditional Access with device compliance enables identity-based access. Microsoft Defender for Cloud offers continuous monitoring, and Azure Policy with audit logging ensures all access to critical servers is logged and audited. Option A is incorrect because Azure Firewall Premium provides perimeter security, not microsegmentation. Option B is incorrect because site-to-site VPN and a single VNet with NSGs do not provide microsegmentation and rely on a perimeter model, not Zero Trust. Option D is incorrect because it uses a third-party SDN in AWS, which is not suitable for a Microsoft-centric environment.

Answer

Deploy Azure Firewall Premium to segment the network. Use Microsoft Entra ID for identity. Use Azure Monitor for logging.

Answer

Use site-to-site VPN to connect all on-premises servers to Azure. Place all servers in a single VNet. Use NSGs for segmentation and Azure AD for identity.

Answer

Deploy a third-party SDN solution in AWS for microsegmentation. Use Microsoft Entra ID for identity. Use CloudWatch for logging.

Question 5

Your organization uses Microsoft Intune to manage iOS and Android devices. You need to ensure that corporate data on these devices is protected in case the device is lost or stolen. The security policy requires that corporate data be automatically removed from the device when it is reported lost, while personal data remains intact. The devices are enrolled in Intune with user affinity. What should you configure?

Accepted Answer

Configure a selective wipe (retire) action that can be triggered via a Power Automate flow when a device is reported lost through a custom app.. Configure a selective wipe (retire) action that can be triggered via a Power Automate flow when a device is reported lost through a custom app. A selective wipe (retire) removes only Intune-managed corporate data from the device while preserving personal data, aligning with the policy requirement. This action can be automated using Power Automate, enabling immediate removal when the device is reported lost. Option C (device wipe) performs a full factory reset, erasing all data including personal data, which violates the policy. Option B (compliance policy after 30 days) does not trigger data removal, and Option D (conditional access) restricts access but does not remove data.

Answer

Create a compliance policy that marks the device as non-compliant after 30 days of inactivity.

Answer

Configure a device wipe action in Intune that can be triggered manually from the console.

Answer

Enable conditional access to require the device to be compliant before accessing data.

Question 6

Your company is designing a secure DevOps pipeline using Azure DevOps. You need to ensure that secrets (e.g., API keys) are stored securely and scanned for leaks in code repositories. The solution must integrate with Azure Policy to prevent deployment if secrets are exposed. You also need to enforce that only approved branches can deploy to production. What should you implement?

Accepted Answer

Store secrets in Azure Key Vault with a service connection. Use GitHub Advanced Security (secret scanning) integrated with Azure DevOps. Use branch policies to require pull requests for production.. Storing secrets in a file in a private Git repo is insecure; secrets should be stored in a secure vault like Azure Key Vault. Option B is incorrect because variable groups can store secrets but they are not automatically scanned for leaks, and Azure Policy cannot directly block deployments based on secrets in code. Option C is correct: Azure Key Vault securely stores secrets, GitHub Advanced Security (when integrated with Azure DevOps) provides secret scanning to detect leaked secrets, and branch policies enforce that only approved branches (via pull requests) can deploy to production. Option D is incorrect because Microsoft Defender for Cloud scans for security vulnerabilities and misconfigurations, but it does not specifically scan for secrets in code repositories; branch policies are a valid control but the scanning element is wrong.

Answer

Store secrets in a file in a private Git repo. Use a custom script to scan for secrets. Use Azure Policy to enforce branch policy.

Answer

Use variable groups in Azure DevOps to store secrets. Use Azure Policy to block deployments if secrets are in code. Use release gates.

Answer

Use Azure Key Vault with managed identities. Use Defender for Cloud to scan for secrets in repos. Use branch policies.

Question 7

Your organization is deploying Azure SQL Managed Instance (SQL MI) with sensitive financial data. You need to design a security solution that includes data encryption at rest and in transit, threat detection, and fine-grained access control. The solution must also ensure that database administrators (DBAs) cannot access the data. What should you include?

Accepted Answer

Enable TDE and Always Encrypted for sensitive columns. Use Azure AD authentication. Enable Microsoft Defender for Cloud (SQL) for threat detection. Use Azure Policy to deny DBA access.. It provides a comprehensive security solution: TDE for at-rest encryption, Always Encrypted for column-level encryption (preventing even DBAs from reading sensitive columns), Azure AD authentication to eliminate SQL authentication vulnerabilities, Microsoft Defender for Cloud (SQL) for threat detection, and Azure Policy to restrict DBA access. This combination addresses all requirements, including ensuring DBAs cannot access data.

Answer

Enable TDE and use server-level firewall rules. Use SQL authentication. Enable auditing.

Answer

Use client-side encryption with Always Encrypted. Use SQL authentication. Enable Advanced Threat Protection.

Answer

Enable TDE and use row-level security (RLS). Use Azure AD authentication. Enable Defender for SQL.

Question 8

Your company uses Microsoft 365 Defender (XDR) for endpoint detection and response. You need to design a solution to automatically remediate malware infections on Windows 10 devices. The solution should isolate the device from the network, run a full antivirus scan, and reset the device if the infection cannot be cleaned. What should you configure?

Accepted Answer

Enable automated investigation and remediation in Microsoft Defender for Endpoint with action settings: isolate, run AV, and reset.. Microsoft Defender for Endpoint supports automated investigation and remediation, which can be configured with the required actions: isolate the device, run a full antivirus scan, and reset the device if the infection cannot be cleaned. This provides the automatic remediation described in the scenario. Option A is manual and does not scale. Option C suggests a third-party tool, but the question specifies using Microsoft 365 Defender (XDR), so a native solution is preferable. Option D uses Intune compliance policies to mark devices non-compliant, but that does not automatically remediate the infection.

Answer

Create a manual incident response process where analysts remotely connect and run scripts.

Answer

Deploy a third-party EDR tool that integrates with Microsoft Sentinel.

Answer

Configure Intune compliance policies to mark infected devices as non-compliant and require user action.

Question 9

Your organization is implementing a privileged access workstation (PAW) strategy for administrators managing Azure resources. The PAWs are Windows 11 devices enrolled in Intune. You need to ensure that only approved applications can run on PAWs, and that device users cannot disable security features. The solution must also enforce that PAWs are used exclusively for administrative tasks. What should you configure?

Accepted Answer

Configure Windows Defender Application Control (WDAC) and AppLocker policies in Intune to allow only approved administrative tools. Use Intune compliance policies to block non-compliant devices. Use Azure AD Conditional Access to require PAW as compliant.. To restrict applications on PAWs, you need Windows Defender Application Control (WDAC) and AppLocker policies, which can be deployed via Intune. Additionally, Intune compliance policies ensure devices meet security requirements, and Azure AD Conditional Access enforces that only compliant PAWs can access administrative portals, ensuring they are used exclusively for admin tasks. Option A is about guest access, not app control. Option C uses PIM and Azure Policy, which do not control what applications run on the device. Option D uses MFA and device compliance but lacks application control, which is crucial for a PAW.

Answer

Enable Azure AD B2B collaboration for external admins. Use Intune to enforce device encryption.

Answer

Assign privileged roles using Azure AD Privileged Identity Management (PIM). Use Azure Policy to audit admin actions.

Answer

Use Azure AD Conditional Access to require multi-factor authentication and device compliance. Use Microsoft Defender for Cloud to monitor for admin activities.

Question 10

Which TWO Azure policies should you assign to enforce secure configuration of Azure SQL Database? (Select two.)

Accepted Answer

Ensure that 'Auditing' is set to 'On' for SQL Database. Enabling Auditing on Azure SQL Database captures all database events and writes them to an audit log in your Azure storage account, Log Analytics workspace, or Event Hubs. This is a fundamental security control for compliance and forensic analysis, as it provides a record of who did what and when, which is essential for detecting and investigating unauthorized access or changes.

Answer

Ensure that 'TDE' is enabled for SQL Server VMs

Answer

Audit SQL Server level audit setting

Answer

Ensure secure transfer to storage accounts is enabled

Question 11

Your company uses Azure Firewall to filter outbound traffic from a virtual network. You need to allow only HTTP and HTTPS traffic to specific FQDNs, while blocking all other outbound traffic. Which Azure Firewall rule type should you use?

Accepted Answer

Application rule. Application rules in Azure Firewall allow filtering outbound traffic based on fully qualified domain names (FQDNs) for HTTP and HTTPS protocols. Option A is wrong because NAT rules only perform destination network address translation, not FQDN filtering. Option C is wrong because threat intelligence rules are used to block traffic from known malicious IP addresses, not for allowing FQDNs. Option D is wrong because network rules filter traffic based on IP addresses, ports, and protocols, not FQDNs.

Answer

NAT rule

Answer

Threat intelligence rule

Answer

Network rule

Question 12

Your company is designing a Zero Trust network for a hybrid workforce. Remote users connect via VPN to on-premises resources, while cloud apps use Microsoft Entra ID. You need to enforce conditional access based on device compliance and user risk. Which Microsoft security solution should you integrate with Entra ID to provide real-time device posture signals?

Accepted Answer

Microsoft Intune. Microsoft Intune provides device compliance policies and can send device posture signals to Entra ID Conditional Access. With Intune, you can enforce device health and compliance requirements before granting access. Option A is wrong because Microsoft Purview focuses on data governance and compliance, not device management. Option C is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) and does not directly manage device compliance. Option D is wrong because Microsoft Sentinel is a security information and event management (SIEM) solution and does not provide device posture signals.

Answer

Microsoft Purview

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 13

Which THREE components are required to implement a Zero Trust network architecture using Microsoft Entra Internet Access (formerly Microsoft 365 Network Connectivity)?

Accepted Answer

Conditional Access policies. Options A, D, and E are correct. Conditional Access policies enforce access controls based on user, device, and location signals. Microsoft Intune device compliance policies ensure devices meet security requirements before access. Microsoft Entra Internet Access (formerly Microsoft Global Secure Access) is the core Zero Trust network gateway, providing secure internet and SaaS access. Option B (Azure AD Application Proxy, now Entra Application Proxy) is incorrect because it is designed for publishing legacy on-premises apps, not as a core component of Zero Trust network architecture. Option C (Site-to-site VPN) is incorrect as it represents traditional perimeter-based network access, which Zero Trust aims to replace.

Answer

Azure AD Application Proxy

Answer

Site-to-site VPN

Question 14

Which TWO Microsoft Purview solutions should you use to protect sensitive data in Microsoft 365? (Choose two.)

Accepted Answer

Sensitivity labels and policies.. The correct answers are Sensitivity labels and policies (C) and Data Loss Prevention (DLP) policies (E). Sensitivity labels allow classification and protection of sensitive data at rest and in transit, while DLP policies help prevent unauthorized sharing of sensitive data. Option A (Audit) is incorrect because it only provides logging and monitoring, not direct data protection. Option B (Insider Risk Management) is incorrect as it focuses on detecting risky user behavior but does not directly protect data. Option D (eDiscovery) is designed for legal discovery and does not protect data.

Answer

Microsoft Purview Audit.

Answer

Insider Risk Management.

Answer

Microsoft Purview eDiscovery.

Question 15

Your organization is designing a hybrid identity infrastructure with Microsoft Entra ID. You need to ensure that users can access on-premises applications using passwordless authentication and that the solution minimizes latency for authentication requests. What should you implement?

Accepted Answer

Use Microsoft Entra application proxy to publish the on-premises applications and enable passwordless authentication.. Microsoft Entra application proxy provides secure remote access to on-premises web applications by publishing them through the Microsoft Entra ID service. It allows users to authenticate using passwordless methods (e.g., Windows Hello, FIDO2, Microsoft Authenticator) and minimizes latency by proxying requests through Microsoft's infrastructure without requiring a VPN. Option A is incorrect because Microsoft Entra Domain Services is for domain-joined VMs, not for publishing applications. Option C is incorrect because Web Application Proxy is a legacy on-premises component that does not integrate with passwordless authentication and lacks the software-defined perimeter capabilities of Entra application proxy. Option D is incorrect because VPNs introduce latency and do not inherently support passwordless authentication.

Answer

Join the on-premises servers to Microsoft Entra Domain Services and use passwordless authentication.

Answer

Install Web Application Proxy (WAP) on-premises and integrate with Microsoft Entra ID for passwordless.

Answer

Deploy a VPN and use Microsoft Entra ID with passwordless sign-in.