SC-100 Design security solutions for infrastructure Practice Test 16 — 15 Questions

Question 1

You are designing a secure remote access solution for employees using Windows 10/11 devices that are managed by Microsoft Intune. The solution must enforce device compliance before allowing access to corporate resources and must support single sign-on (SSO). Which technology should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Microsoft Entra ID with Conditional Access policies that require compliant devices.. The correct option is D: Microsoft Entra ID with Conditional Access policies that require compliant devices. Conditional Access is the policy engine that evaluates signals such as Intune device compliance status and enforces access decisions to corporate resources, while Entra ID provides the identity platform that enables single sign-on (SSO) across integrated applications. This directly satisfies both requirements: compliance-gated access and SSO for managed Windows 10/11 devices. Option A (traditional VPN with certificate-based authentication) can restrict access but does not natively evaluate Intune compliance or deliver SSO to cloud apps. Option B (Microsoft Entra application proxy) publishes on-premises web apps for remote access but is not a compliance enforcement or SSO mechanism by itself. Option C (Microsoft Defender for Endpoint) is an endpoint detection and response service and does not act as the access-control gate for corporate resources.

Answer

Deploy a traditional VPN with certificate-based authentication.

Answer

Set up Azure AD Application Proxy for remote access.

Answer

Implement Microsoft Defender for Endpoint to block non-compliant devices.

Question 2

Your organization uses Azure SQL Database and needs to protect sensitive data from being exported by unauthorized users. You must implement a solution that prevents users from copying data to clipboard or taking screenshots of query results, while allowing legitimate business operations. What should you implement?

Accepted Answer

Configure a session policy in Microsoft Defender for Cloud Apps to block clipboard and screenshot actions.. The correct option is D: configuring a session policy in Microsoft Defender for Cloud Apps to block clipboard and screenshot actions. Defender for Cloud Apps Conditional Access App Control uses a session policy to proxy the session and apply controls such as blocking copy/paste to the clipboard and preventing screenshots, which directly addresses the requirement while still permitting legitimate query operations. Option A is incorrect because Azure Information Protection labels classify and protect data at rest or in documents, not interactive query result sessions. Option B is incorrect because Dynamic Data Masking only obscures column values in query output and does not prevent copying or screenshotting. Option C is incorrect because Auditing and threat detection only log and alert on suspicious activity; they do not block clipboard or screenshot actions.

Answer

Apply Azure Information Protection labels to the database.

Answer

Use Dynamic Data Masking to obscure sensitive columns.

Answer

Enable Azure SQL Database Auditing and threat detection.

Question 3

You are designing a backup strategy for Azure virtual machines that host a mission-critical application. The solution must support daily backups with a retention of 30 days for daily backups, weekly backups retained for 12 weeks, and monthly backups retained for 3 years. What should you use?

Accepted Answer

Azure Backup with a backup policy that specifies daily, weekly, and monthly retention.. Azure Backup with a backup policy that specifies daily, weekly, and monthly retention (option D) is correct because Azure Backup for virtual machines natively supports long-term retention through policy rules that define daily, weekly, monthly, and yearly retention durations, exactly matching the required 30-day daily, 12-week weekly, and 3-year monthly schedule. Azure Backup also provides application-consistent snapshots and recovery points for mission-critical VMs without custom scripting. Option A is wrong because Azure Files backup targets file shares, not VM disks, and requires custom scripting that Azure Backup handles natively. Option B is wrong because Azure Disk Backup only supports snapshot-based retention up to a limited period and does not provide the multi-tier daily/weekly/monthly retention policy required. Option C is wrong because Azure Site Recovery is a disaster-recovery replication service, not a backup solution with retention policies.

Answer

Azure Files backup with a custom script.

Answer

Azure Disk Backup with a snapshot schedule.

Answer

Azure Site Recovery with a recovery plan.

Question 4

You are a security architect for a healthcare organization that is adopting Microsoft 365 and Azure. The organization must comply with HIPAA and has the following requirements: - All users must use multi-factor authentication (MFA) when accessing Microsoft 365 from outside the corporate network. - Mobile devices must be managed and must be compliant before accessing email. - Access to Azure virtual machines must be limited to specific admin users and must be audited. - All sensitive data stored in Azure SQL Database must be encrypted at rest and in transit. You have the following technologies: Microsoft Entra ID, Microsoft Intune, Azure SQL Database, Azure Policy, Azure Key Vault, Microsoft Defender for Cloud, and Azure Bastion. Which combination of services and configurations should you implement?

Accepted Answer

Configure Conditional Access policies for MFA, use Intune compliance policies for mobile devices, deploy Azure Bastion for VM access with audit logging, and enable TDE and enforce TLS for Azure SQL Database.. It maps each requirement to the appropriate native service: Conditional Access policies enforce MFA for external Microsoft 365 access, Intune compliance policies gate mobile email access on managed compliant devices, Azure Bastion provides audited RDP/SSH access to Azure VMs limited to specific admins without exposing public IPs, and TDE plus enforced TLS encrypt Azure SQL Database at rest and in transit. The other options miss key controls: A uses Microsoft Entra application proxy (for web apps, not VM RDP/SSH) and Always Encrypted alone doesn't cover at-rest database encryption or transit TLS; B uses PIM (privileged role activation, not MFA enforcement) and Azure VPN Gateway (network connectivity, not audited admin access); D uses Azure Firewall (network filtering, not VM admin access) and Key Vault (key storage, not SQL data encryption).

Answer

Configure Conditional Access to require MFA only for external access, use Intune for mobile device management, deploy Always Encrypted for Azure SQL Database, and use Azure AD Application Proxy for VM access.

Answer

Configure Microsoft Entra PIM for MFA, use Intune for mobile devices, deploy Azure VPN Gateway for VM access, and enable Double Encryption for Azure SQL Database.

Answer

Use Azure AD Identity Protection for MFA, use Microsoft Endpoint Manager for device compliance, deploy Azure Firewall for VM access, and use Azure Key Vault for SQL encryption keys.

Question 5

Your organization is deploying a new application on Azure Kubernetes Service (AKS). You need to ensure that only authorized containers can run in the cluster and that any unauthorized containers are automatically blocked. What should you configure?

Accepted Answer

Apply an Azure Policy that restricts container images to only those from approved registries.. The correct option is B: applying an Azure Policy that restricts container images to only those from approved registries. Azure Policy for AKS uses the Gatekeeper admission controller to evaluate requests against policy definitions at admission time, so any pod or deployment referencing a non-approved image is automatically denied and blocked from running in the cluster. This directly enforces the requirement that only authorized containers can run. Option A does not fit because network policies only control pod-to-pod traffic, not which images are allowed to run. Option C does not fit because Microsoft Entra ID integration handles authentication of users to the cluster, not image authorization. Option D does not fit because Azure RBAC controls who can perform deployment actions, but it does not validate or block unauthorized container images.

Answer

Implement network policies to restrict communication between pods.

Answer

Enable Azure AD integration for the AKS cluster.

Answer

Configure Azure RBAC roles to limit who can deploy containers.

Question 6

Your organization is implementing a defense-in-depth strategy for a multi-tier application hosted on Azure. You need to secure the network layers. Which THREE measures should you implement?

Accepted Answer

Enable Azure DDoS Protection on the virtual network.. Azure DDoS Protection (A) is correct because it defends the virtual network against volumetric and protocol-layer attacks targeting the network/infrastructure layer, which is a core component of defense-in-depth for a multi-tier Azure application. Azure Firewall (C) is correct because it provides stateful traffic inspection, filtering, and centralized policy enforcement (FQDN, network, and application rules) between tiers and to/from the internet, adding a managed network-layer control. Network security groups (E) are correct because NSGs enforce Layer 3/Layer 4 allow/deny rules on subnets and NICs, segmenting traffic between the application's tiers (for example, allowing only the web tier to reach the app tier on specific ports). Azure Front Door (B) is not selected because it is a Layer 7 web application firewall/CDN service, so it addresses the application layer rather than the network layers this scenario asks to secure. A site-to-site VPN gateway (D) is not selected because it provides encrypted connectivity between on-premises networks and Azure, which is a hybrid connectivity measure, not a network-layer security control for the multi-tier application.

Answer

Configure Azure Front Door to protect the application layer.

Answer

Deploy a site-to-site VPN gateway.

Question 7

You are designing a secure infrastructure for an Azure Kubernetes Service (AKS) cluster that will host sensitive workloads. Which TWO configurations should you implement to secure the cluster?

Accepted Answer

Enable Azure AD integration for role-based access control (RBAC).. Option A is correct because enabling Microsoft Entra ID integration for RBAC ties Kubernetes authorization to Microsoft Entra ID identities and group memberships, so cluster access is centrally governed and auditable rather than relying on static client certificates or local accounts. Option D is correct because Microsoft Entra ID pod identity (now largely superseded by Azure Workload Identity) lets pods obtain Microsoft Entra ID tokens via managed identities, eliminating the need to store credentials or secrets in containers for accessing Azure resources like Key Vault. Option B is not a security control but an observability feature, so it does not itself secure the cluster. Option C is incorrect and even risky, since the HTTP application routing add-on exposes an ingress endpoint and is intended for dev/test, not hardened production workloads. Option E is a scaling feature that improves availability and cost, not a security configuration.

Answer

Enable Azure Monitor for containers.

Answer

Enable the HTTP application routing add-on.

Answer

Enable the cluster autoscaler.

Question 8

You are the security architect for a company that has a hybrid identity infrastructure with Microsoft Entra ID (formerly Azure AD) and an on-premises Active Directory Domain Services (AD DS) forest. The company is planning to migrate several line-of-business (LOB) applications to Azure Virtual Machines. The applications currently use Windows Integrated Authentication (WIA) and rely on Kerberos delegation. You need to design a solution that allows the Azure VMs to authenticate on-premises users and access on-premises resources using Kerberos constrained delegation (KCD) without exposing on-premises-domain controllers to the internet. The solution must minimize latency and administrative overhead. You have configured Azure ExpressRoute for connectivity between the on-premises network and Azure. What should you do?

Accepted Answer

Deploy domain controllers as Azure VMs in the same virtual network as the application VMs. Configure the application VMs to use these domain controllers for authentication and KCD.. Option A is correct because deploying replica domain controllers as Azure VMs in the same virtual network as the application VMs keeps Kerberos authentication and KCD traffic local to Azure, minimizing latency while avoiding any internet exposure of on-premises domain controllers; the VMs join the on-premises AD DS domain and use these in-Azure DCs for authentication and delegation. Option D would work functionally over ExpressRoute but adds WAN latency and dependency on the on-premises DCs for every Kerberos exchange, so it does not minimize latency. Option C is wrong because Microsoft Entra Domain Services (Microsoft Entra Domain Services) is a managed domain that does not support Kerberos constrained delegation to on-premises resources or joining an existing on-premises AD DS forest. Option B is wrong because Microsoft Entra application proxy publishes web apps for remote access and uses Entra ID authentication, which does not provide Kerberos KCD for LOB applications running on Azure VMs.

Answer

Implement Azure AD Application Proxy to publish the applications and use Azure AD for authentication.

Answer

Use Azure AD Domain Services to provide domain join and KCD capabilities for the Azure VMs.

Answer

Configure the application VMs to use the on-premises domain controllers over ExpressRoute for authentication and KCD.

Question 9

Your organization is using Microsoft Defender for Cloud to manage security across multiple Azure subscriptions. You need to ensure that all virtual machines in the subscriptions are monitored by Defender for Cloud and that security alerts are sent to the security operations team. You also need to enforce that any new VMs are automatically onboarded to Defender for Cloud. You have a Log Analytics workspace in the central subscription. What should you do?

Accepted Answer

In Defender for Cloud, enable auto-provisioning for the Log Analytics agent at the management group level and specify the central workspace.. Enabling auto-provisioning of the Log Analytics agent at the management group scope ensures all VMs across subscriptions are monitored and new VMs are automatically onboarded. Option A is wrong because configuring only the workspace does not auto-provision. Option B is wrong because Azure Policy can enforce agent deployment, but auto-provisioning is simpler and more direct. Option D is wrong because enabling Defender for Cloud at the subscription level does not automatically install the agent.

Answer

Enable Defender for Cloud on each subscription and configure email notifications for alerts.

Answer

Assign an Azure Policy that deploys the Log Analytics agent to all VMs.

Answer

Create a Log Analytics workspace in each subscription and configure Defender for Cloud to use that workspace.

Question 10

Your company has an Azure subscription that contains multiple virtual machines (VMs) running Windows Server. You need to ensure that all VMs are compliant with your organization's security baseline. The security baseline includes specific registry key settings, password policies, and service configurations. You want to continuously monitor and automatically remediate non-compliant VMs. What should you implement?

Accepted Answer

Use Azure Policy with Guest Configuration extension to audit and remediate the VM settings.. Azure Policy with the Guest Configuration extension is the correct choice because it is designed to audit and remediate OS-level settings inside Azure VMs, including registry keys, password policies, and service configurations, using built-in or custom guest configuration packages. It continuously evaluates compliance and supports remediation tasks (DeployIfNotExists) to automatically bring non-compliant VMs back into the baseline. Azure Automation State Configuration (option A) can apply DSC, but it is a legacy approach and does not provide the same policy-driven continuous compliance and automatic remediation integration as Azure Policy Guest Configuration. Azure Update Manager (option C) only handles OS and software patching, not security baseline settings, and Microsoft Defender for Cloud (option D) provides recommendations and alerts but does not automatically remediate these specific configuration items by itself.

Answer

Deploy Azure Automation State Configuration to apply Desired State Configuration (DSC) to the VMs.

Answer

Use Azure Update Manager to ensure VMs are up to date.

Answer

Enable Microsoft Defender for Cloud and review the security recommendations.

Question 11

Your organization is using Microsoft Sentinel to collect security logs from multiple sources, including Azure Activity Logs, Office 365 Audit Logs, and on-premises Windows Event Logs. You need to ensure that security incidents are automatically created when a user from a specific IP address attempts to access a sensitive application. You have already configured the data connectors. What should you create?

Accepted Answer

Create an analytics rule that triggers an incident when access from the IP is detected.. The correct option is C: Create an analytics rule that triggers an incident when access from the IP is detected. In Microsoft Sentinel, analytics rules are the built-in mechanism that evaluates ingested log data against detection logic and automatically generates incidents when conditions match, which is exactly what is required to flag access attempts from a specific IP to a sensitive application. A watchlist (option B) can store the IP for reference or enrichment in queries, but by itself it does not create incidents. A workbook (option A) is only a visualization/reporting tool and takes no automated action, and a playbook (option D) is an automation workflow that responds to incidents or alerts but does not itself detect the access or create the incident.

Answer

Create a workbook to visualize the access attempts.

Answer

Create a watchlist containing the IP address and use it in a query.

Answer

Create a playbook that runs when a specific event occurs.

Question 12

Your company uses Microsoft 365 Defender (XDR) for endpoint detection and response. You need to design a solution to automatically remediate malware infections on Windows 10 devices. The solution should isolate the device from the network, run a full antivirus scan, and reset the device if the infection cannot be cleaned. What should you configure?

Accepted Answer

Enable automated investigation and remediation in Microsoft Defender for Endpoint with action settings: isolate, run AV, and reset.. Enabling automated investigation and remediation in Microsoft Defender for Endpoint with action settings for isolate, run AV, and reset. This directly satisfies the scenario because Defender for Endpoint's AIR capabilities can automatically isolate a compromised Windows 10 device, trigger a full antivirus scan, and reset the device when remediation cannot clean the infection. Option A is manual and does not provide automatic remediation, while option C introduces a third-party tool that is unnecessary and not specified as available. Option D only marks devices non-compliant and requires user action, so it does not isolate, scan, or reset the device automatically.

Answer

Create a manual incident response process where analysts remotely connect and run scripts.

Answer

Deploy a third-party EDR tool that integrates with Microsoft Sentinel.

Answer

Configure Intune compliance policies to mark infected devices as non-compliant and require user action.

Question 13

You are the security architect for a company that uses Microsoft Defender for Cloud. The company has Azure virtual machines (VMs) and on-premises Windows Servers onboarded to Microsoft Defender for Servers Plan 2. The security team requires that all servers be protected against fileless attacks and that suspicious process behavior be detected in near real-time. You need to recommend a solution that meets these requirements while minimizing administrative effort. What should you include in your recommendation?

Accepted Answer

Enable Microsoft Defender for Endpoint integration and ensure that the automatic provisioning of the Microsoft Defender for Endpoint agent is turned on for all supported machines.. The requirement is for advanced endpoint detection and response, specifically fileless attack detection and behavioral monitoring. Microsoft Defender for Servers Plan 2 includes Defender for Endpoint integration, which delivers these capabilities. Automatic provisioning ensures the agent is deployed to all supported machines with minimal administrative effort, satisfying both the technical and operational requirements.

Answer

Enable just-in-time (JIT) VM access for all servers to limit exposure to brute-force attacks.

Answer

Configure adaptive application controls in Microsoft Defender for Cloud to allow only approved applications to run on the servers.

Answer

Deploy the Log Analytics agent to all servers and create custom alerts based on Windows Security event logs.

Question 14

You are the security architect for a company that uses Azure Virtual Machines (VMs) running Windows Server and Linux. The company has a regulatory requirement that all VM disks must be encrypted at rest, including temporary disks and disk caches. You need to recommend a solution that meets the requirement and minimizes administrative overhead. What should you recommend?

Accepted Answer

Enable encryption at host for all VMs.. Encryption at host is the only option that encrypts all VM data, including temporary disks and disk caches, at the host level. It requires no guest OS configuration and simplifies key management compared to Azure Disk Encryption. The other options either do not cover temporary disks and caches or add unnecessary administrative complexity.

Answer

Enable Azure Disk Encryption (ADE) on each VM.

Answer

Use Azure Storage Service Encryption (SSE) for all VM disks.

Answer

Configure BitLocker on Windows VMs and DM-Crypt on Linux VMs.

Question 15

You are designing a security solution for an Azure environment that includes several storage accounts containing sensitive data. The company requires that all data in transit to the storage accounts be encrypted and that access be restricted to specific virtual networks. You need to recommend a solution that enforces these requirements and provides visibility into any non-compliant storage accounts. What should you recommend?

Accepted Answer

Enable secure transfer required on all storage accounts and configure network rules to allow access only from selected virtual networks and IP addresses. Use Azure Policy to deny creation of storage accounts that do not meet these settings.. The requirements are to enforce encryption in transit and restrict network access to specific virtual networks. Enabling secure transfer required ensures that all requests to the storage account use HTTPS, enforcing encryption in transit. Network rules can be configured to allow access only from selected virtual networks and IP addresses. Azure Policy with a deny effect ensures that new storage accounts cannot be created without these settings, providing preventive enforcement.

Answer

Deploy a network virtual appliance (NVA) to inspect all traffic to storage accounts and enforce encryption. Use Azure Policy to audit compliance.

Answer

Configure Azure Policy to audit storage accounts that do not require secure transfer and that allow access from all networks. Enable Defender for Storage to detect anomalies.

Answer

Use Azure Private Link to create private endpoints for all storage accounts and disable public access. Enable Microsoft Defender for Storage for threat detection.