SC-100 Design security solutions for infrastructure Practice Test 2 — 15 Questions

Question 1

A multinational corporation uses Microsoft Entra ID with hybrid identities. They need to design a solution that automatically remediates risky sign-ins without user intervention. Which feature should you enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Identity Protection with Conditional Access policies. Microsoft Entra ID Identity Protection with Conditional Access policies can automatically remediate risky sign-ins by requiring MFA, blocking access, or requiring password change based on risk levels. Option A is wrong because Entra ID Governance (Access Reviews) focuses on reviewing and recertifying access, not automatic risk remediation. Option B is wrong because Privileged Identity Management (PIM) manages privileged role activation and approvals, not risk-based sign-in remediation. Option C is wrong because Microsoft Defender for Identity is an on-premises identity security solution that detects threats but does not automatically remediate sign-in risks in the cloud.

Answer

Entra ID Governance (Access Reviews)

Answer

Privileged Identity Management (PIM)

Answer

Microsoft Defender for Identity

Question 2

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to design a solution that automatically creates an incident in Sentinel when a Defender XDR alert fires. Which integration should you configure?

Accepted Answer

Microsoft Defender XDR data connector in Sentinel. The Microsoft Defender XDR data connector in Sentinel allows alert streaming and automatic incident creation. Option A is wrong because Azure Logic Apps can automate responses but is not the primary integration for automatic incident creation; the data connector is the standard method. Option B is wrong because Microsoft Power Automate can be used but is not the primary integration; the data connector is the designed method. Option D is wrong because Microsoft Graph API provides programmatic access but is not the configured integration for automatic incident creation.

Answer

Azure Logic Apps with Defender XDR connector

Answer

Microsoft Power Automate flow triggered by Defender XDR alerts

Answer

Microsoft Graph API subscription to Defender XDR alerts

Question 3

Your company is migrating to Azure and needs to secure virtual networks with network segmentation. You need to design a solution that filters traffic between subnets based on application requirements. Which Azure service should you use?

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) are used to filter network traffic between Azure resources, such as subnets and VMs, based on rules you define. They provide stateful packet filtering and are ideal for network segmentation within a virtual network. Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources, but it operates at a higher level (e.g., between VNets and on-premises) and is not the primary service for subnet-to-subnet filtering. Azure DDoS Protection protects against distributed denial-of-service attacks, not segmentation. Azure Bastion provides secure RDP/SSH access to VMs without exposing public IPs.

Answer

Azure DDoS Protection

Answer

Azure Firewall

Answer

Azure Bastion

Question 4

Your organization uses Microsoft Defender for Cloud to assess security posture. You need to design a solution that automatically applies a security baseline to new Azure VMs. Which feature should you use?

Accepted Answer

Azure Policy with Guest Configuration. Azure Policy with Guest Configuration can apply security baselines to VMs at scale. Option A is wrong because Defender for Cloud provides recommendations but does not automatically apply baselines. Option B is wrong because Azure Update Management handles patching, not baselines. Option C is wrong because Azure Automation State Configuration (DSC) can apply configurations but Azure Policy is more integrated.

Answer

Microsoft Defender for Cloud regulatory compliance dashboard

Answer

Azure Update Management

Answer

Azure Automation State Configuration (DSC)

Question 5

Your company uses Microsoft Intune to manage devices. You need to design a solution that prevents users from installing unauthorized applications on corporate Windows 10 devices. Which Intune policy should you configure?

Accepted Answer

Device restriction policy (Windows 10). Device restriction policy (Windows 10). Device restriction policies in Intune allow you to block installation of apps from untrusted sources, effectively preventing users from installing unauthorized applications. Option A (Compliance policy) is incorrect because compliance policies assess device compliance with rules but do not control app installation. Option B (App protection policy, MAM) is incorrect because app protection policies apply to managed apps and protect data within those apps, not device-wide installation. Option D (Configuration policy, OMA-URI) is incorrect because configuration policies set device settings like Wi-Fi or email, but not app installation control.

Answer

Compliance policy

Answer

App protection policy (MAM)

Answer

Configuration policy (OMA-URI)

Question 6

Your organization uses Microsoft Purview to classify data assets. You need to design a solution that automatically scans data sources in Azure SQL Database for sensitive information. Which Purview scanner should you configure?

Accepted Answer

Purview scanning rule set for Azure SQL Database. Microsoft Purview uses scanning rule sets to define the types of sensitive information to detect during a scan. For Azure SQL Database, you configure a scanning rule set tailored to SQL data classifications. Option A is incorrect because Purview does not have a scanner named 'Azure SQL Scanner'; instead, it relies on built-in scan capabilities and rule sets. Option C is incorrect because Purview Insights is a reporting and analytics feature, not a scanner. Option D is incorrect because Microsoft Defender for SQL is a security monitoring solution, not a data classification scanner.

Answer

Azure SQL Scanner (Purview)

Answer

Purview Insights

Answer

Microsoft Defender for SQL

Question 7

Which TWO actions should you take to secure an Azure Kubernetes Service (AKS) cluster using Microsoft Defender for Cloud?

Accepted Answer

Apply built-in Azure Policy initiatives for AKS. Options A and D are correct because enabling Microsoft Defender for Containers provides threat detection and vulnerability scanning for AKS clusters, and applying built-in Azure Policy initiatives ensures compliance with security best practices. Option B is incorrect because enabling private cluster mode is a network configuration, not a Microsoft Defender for Cloud action. Option C is incorrect because configuring NSGs on subnets is a general networking practice and not specific to Defender for Cloud. Option E is incorrect because deploying Azure Firewall is a network security tool, but it is not part of the Defender for Cloud security controls for AKS.

Answer

Enable private cluster mode

Answer

Configure Network Security Groups (NSGs) on AKS subnets

Answer

Deploy Azure Firewall in the AKS virtual network

Question 8

Which TWO Azure services should you use to implement a defense-in-depth strategy for protecting Azure virtual machines?

Accepted Answer

Network Security Groups (NSGs). Options A and C are correct because Network Security Groups (NSGs) provide network segmentation and Azure Backup provides data protection, both essential layers in a defense-in-depth strategy. Option B (Azure Logic Apps) is incorrect because it is an integration and workflow service, not a security service for VMs. Option D (Azure Automation) is incorrect because it is used for process automation and configuration management, not for direct VM protection. Option E (Azure Front Door) is incorrect because it is a global load balancer and application delivery controller, not a VM security service.

Answer

Azure Logic Apps

Answer

Azure Automation

Answer

Azure Front Door

Question 9

You are designing a hybrid identity solution for an organization that uses Microsoft Entra ID and an on-premises Active Directory. The organization requires that users who are located in a remote office without a direct VPN connection to the main office can authenticate against on-premises resources using their Entra ID credentials. The solution must minimize latency and support passwordless authentication. Which feature should you implement?

Accepted Answer

Implement Microsoft Entra Kerberos authentication. Microsoft Entra Kerberos authentication enables users to authenticate to on-premises resources using their Entra ID credentials without requiring a VPN, and it supports passwordless methods like FIDO2 and Windows Hello for Business. Option A is incorrect because Entra Application Proxy is designed for publishing on-premises web applications, not for general authentication. Option C is incorrect because Conditional Access policies enforce access controls but do not provide authentication or passwordless capabilities. Option D is incorrect because Entra Connect Sync with password hash synchronization only syncs password hashes and does not support real-time passwordless authentication without a VPN.

Answer

Configure Microsoft Entra Application Proxy

Answer

Enable Microsoft Entra Conditional Access policies

Answer

Deploy Microsoft Entra Connect Sync with password hash synchronization

Question 10

Your organization is designing a secure network infrastructure for a multi-cloud environment that includes Azure, AWS, and on-premises datacenters. The security team requires that all traffic between these environments be inspected for threats and that any malicious traffic be automatically blocked. The solution must minimize complexity and use a single pane of glass for policy management. Which Azure service should you use as the central hub?

Accepted Answer

Azure Firewall. Azure Firewall can be deployed as a central hub in a hub-and-spoke topology, providing network-level traffic inspection for Azure, on-premises (via ExpressRoute or VPN), and even AWS (via VPN or Azure Virtual WAN). It offers integrated threat intelligence and supports routing policies to automatically block malicious traffic. Option A is incorrect because Azure Front Door is a global load balancer and web application firewall, not a network firewall for multi-cloud traffic inspection. Option B is incorrect because Network Security Groups (NSGs) provide basic filtering but lack advanced inspection, threat intelligence, and multi-cloud support. Option C is incorrect because Azure DDoS Protection only mitigates volumetric attacks, not traffic inspection.

Answer

Azure Front Door

Answer

Network Security Groups (NSGs)

Answer

Azure DDoS Protection

Question 11

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure resources. The security team wants to ensure that all virtual machines are covered by Defender for Cloud's vulnerability assessment capabilities. Which plan must be enabled?

Accepted Answer

Microsoft Defender for Servers Plan 2. Microsoft Defender for Servers Plan 2. This plan includes the integrated vulnerability assessment solution for VMs, powered by Qualys or Microsoft Defender Vulnerability Management. Option A (Microsoft Defender for Storage) protects storage accounts, not VMs. Option C (Microsoft Defender for Cloud Apps) focuses on SaaS applications. Option D (Defender CSPM) provides cloud security posture management but does not include VM-specific vulnerability assessment.

Answer

Microsoft Defender for Storage

Answer

Microsoft Defender for Cloud Apps

Answer

Defender Cloud Security Posture Management (CSPM)

Question 12

Your organization is deploying Azure Kubernetes Service (AKS) and plans to use Azure Policy to enforce security controls on the cluster. The security team wants to automatically audit and deny the creation of privileged containers. Which Azure Policy initiative should you assign?

Accepted Answer

Azure Policy for Kubernetes (preview). The Azure Policy for Kubernetes initiative (preview) includes built-in policies to enforce security constraints like preventing privileged containers. Option A is wrong because Azure RBAC roles control permissions, not container security. Option C is wrong because Microsoft Defender for Containers provides monitoring and threat detection but not policy enforcement. Option D is wrong because AKS Pod Identity is for pod authentication to Azure resources.

Answer

Azure RBAC roles for AKS

Answer

Microsoft Defender for Containers

Answer

AKS Pod Identity

Question 13

You are designing a secure access solution for an on-premises application that uses legacy authentication protocols. The organization plans to migrate to Microsoft Entra ID but the application vendor has not yet provided a modern authentication update. The solution must enable single sign-on (SSO) and support multifactor authentication (MFA) for this application without modifying the application code. Which approach should you recommend?

Accepted Answer

Deploy Microsoft Entra Application Proxy with pre-authentication. Microsoft Entra Application Proxy can publish on-premises apps that use legacy authentication protocols. With pre-authentication enabled, the user authenticates first to Microsoft Entra ID, which can enforce MFA and provide SSO, and then the request is proxied to the on-premises app. No changes to the application code are required. Option A is incorrect because the Microsoft Authentication Library (MSAL) requires application code modifications to integrate with modern authentication, which is not feasible without vendor update. Option B is incorrect because simply federating Active Directory with Microsoft Entra ID does not address the app's legacy authentication protocol; the app still cannot accept modern tokens. Option C is incorrect because Microsoft Entra Conditional Access policies can only enforce MFA on applications that support modern authentication; legacy apps do not support this.

Answer

Integrate the application with the Microsoft Authentication Library (MSAL)

Answer

Federate the on-premises Active Directory with Microsoft Entra ID

Answer

Use Microsoft Entra Conditional Access policies to require MFA

Question 14

Your organization uses Microsoft Intune to manage endpoints. The security team wants to ensure that devices that cannot be enrolled in Intune (e.g., unmanaged BYOD devices) are still subject to security policies when accessing corporate resources. Which Microsoft Entra ID feature should you use?

Accepted Answer

Microsoft Entra Conditional Access policies. Microsoft Entra Conditional Access policies can enforce access controls based on device compliance, including requiring MFA or blocking access from unmanaged devices, even if those devices are not enrolled in Intune. Option B is wrong because Intune enrollment policies only apply to devices that are enrolled in Intune, not unmanaged BYOD devices. Option C is wrong because Windows Defender Application Control is a code integrity feature for managed devices and does not control access to corporate resources. Option D is wrong because Microsoft Defender for Endpoint provides threat detection and response capabilities, not access policy enforcement.

Answer

Microsoft Intune enrollment policies

Answer

Windows Defender Application Control

Answer

Microsoft Defender for Endpoint

Question 15

You are designing a security solution for a critical Azure SQL Database that must be protected against data exfiltration by a compromised admin account. The solution must ensure that even a database administrator cannot copy data to an external storage account. Which Azure service should you configure?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention (DLP) policies can be applied to Azure SQL Database to detect and block sensitive data exfiltration attempts, even by a compromised admin. Option A (Always Encrypted) protects data at rest and in use but does not prevent copying. Option B (Azure SQL Database firewall rules) controls network access but does not prevent data exfiltration. Option D (Azure Information Protection) is for classification and labeling, not real-time blocking.

Answer

Always Encrypted

Answer

Azure SQL Database firewall rules

Answer

Azure Information Protection