SC-100 Design security solutions for infrastructure Practice Test 2 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel to monitor hybrid workloads. You need to design a solution to detect lateral movement attempts using pass-the-hash attacks. Which data source should you prioritize for ingestion?

Accepted Answer

Windows Security Events (Event ID 4624). Option B is correct because Windows Security Event ID 4624 (successful logon) with LogonType 3 (network) and hashed credentials is key for detecting pass-the-hash. Option A is wrong because Azure Activity Logs record control plane events, not authentication details. Option C is wrong because Sysmon Event ID 1 is process creation, not authentication. Option D is wrong because DNS logs may show network connections but not credential theft.

Answer

Sysmon Event ID 1 (Process creation)

Answer

DNS Query Logs

Answer

Azure Activity Logs

Question 2

Your company is designing a Zero Trust network for a hybrid workforce. Remote users connect via VPN to on-premises resources, while cloud apps use Microsoft Entra ID. You need to enforce conditional access based on device compliance and user risk. Which Microsoft security solution should you integrate with Entra ID to provide real-time device posture signals?

Accepted Answer

Microsoft Intune. Option C is correct because Microsoft Intune provides device compliance policies that integrate with Entra ID Conditional Access. Option A is wrong because Microsoft Defender for Cloud Apps is a CASB, not a device management solution. Option B is wrong because Microsoft Purview focuses on data governance. Option D is wrong because Microsoft Sentinel is a SIEM/SOAR, not a device management tool.

Answer

Microsoft Purview

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 3

You are designing a secure infrastructure for an e-commerce platform hosted on Azure. The platform must meet PCI DSS compliance. Which Azure service should you use to centrally manage and monitor security policies across subscriptions?

Accepted Answer

Azure Policy. Option A is correct because Azure Policy allows you to enforce compliance rules across subscriptions. Option B is wrong because Azure Blueprints is deprecated; Azure Policy is the current recommendation. Option C is wrong because Azure Firewall is a network security appliance, not a policy management tool. Option D is wrong because Azure Security Center is now part of Defender for Cloud, which uses policies but the core policy engine is Azure Policy.

Answer

Azure Firewall

Answer

Microsoft Defender for Cloud

Answer

Azure Blueprints

Question 4

A multinational corporation uses Microsoft Entra ID with hybrid identities. They need to design a solution that automatically remediates risky sign-ins without user intervention. Which feature should you enable?

Accepted Answer

Identity Protection with Conditional Access policies. Option B is correct because Entra ID Identity Protection with conditional access policies can block or require MFA automatically based on risk. Option A is wrong because PIM is for privileged identity management, not risk-based remediation. Option C is wrong because Entra ID Governance is for access reviews and entitlement management. Option D is wrong because Microsoft Defender for Identity is for on-premises identity protection, not automatic remediation.

Answer

Entra ID Governance (Access Reviews)

Answer

Privileged Identity Management (PIM)

Answer

Microsoft Defender for Identity

Question 5

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to design a solution that automatically creates an incident in Sentinel when a Defender XDR alert fires. Which integration should you configure?

Accepted Answer

Microsoft Defender XDR data connector in Sentinel. Option C is correct because the Microsoft Defender XDR connector in Sentinel allows alert streaming and incident creation. Option A is wrong because Microsoft Power Automate can be used but is not the primary integration. Option B is wrong because Logic Apps can automate but the connector is the standard method. Option D is wrong because Microsoft Graph API is programmatic but not the designed integration.

Answer

Azure Logic Apps with Defender XDR connector

Answer

Microsoft Power Automate flow triggered by Defender XDR alerts

Answer

Microsoft Graph API subscription to Defender XDR alerts

Question 6

Your company is migrating to Azure and needs to secure virtual networks with network segmentation. You need to design a solution that filters traffic between subnets based on application requirements. Which Azure service should you use?

Accepted Answer

Network Security Groups (NSGs). Option B is correct because Network Security Groups (NSGs) filter traffic between subnets and VMs. Option A is wrong because Azure Firewall is a managed firewall for inbound/outbound but at a higher level. Option C is wrong because Azure DDoS Protection mitigates DDoS attacks, not segmentation. Option D is wrong because Azure Bastion is for secure RDP/SSH access.

Answer

Azure DDoS Protection

Answer

Azure Firewall

Answer

Azure Bastion

Question 7

Your organization uses Microsoft Defender for Cloud to assess security posture. You need to design a solution that automatically applies a security baseline to new Azure VMs. Which feature should you use?

Accepted Answer

Azure Policy with Guest Configuration. Option D is correct because Azure Policy with Guest Configuration can apply security baselines to VMs at scale. Option A is wrong because Defender for Cloud provides recommendations but does not automatically apply baselines. Option B is wrong because Azure Automation State Configuration (DSC) can apply configurations but Azure Policy is more integrated. Option C is wrong because Azure Update Management handles patching, not baselines.

Answer

Microsoft Defender for Cloud regulatory compliance dashboard

Answer

Azure Update Management

Answer

Azure Automation State Configuration (DSC)

Question 8

Your company uses Microsoft Intune to manage devices. You need to design a solution that prevents users from installing unauthorized applications on corporate Windows 10 devices. Which Intune policy should you configure?

Accepted Answer

Device restriction policy (Windows 10). Option A is correct because Intune device restriction policies can block installation of apps from untrusted sources. Option B is wrong because app protection policies apply to managed apps, not device-wide installation. Option C is wrong because compliance policies assess device state but do not block installation. Option D is wrong because configuration policies set settings but not app installation control.

Answer

Compliance policy

Answer

App protection policy (MAM)

Answer

Configuration policy (OMA-URI)

Question 9

Your organization uses Microsoft Purview to classify data assets. You need to design a solution that automatically scans data sources in Azure SQL Database for sensitive information. Which Purview scanner should you configure?

Accepted Answer

Purview scanning rule set for Azure SQL Database. Option C is correct because Purview's scanning capability supports Azure SQL Database natively. Option A is wrong because Purview does not have a scanner named 'Azure SQL Scanner'; it uses the built-in scan. Option B is wrong because Microsoft Defender for SQL is a security product, not a classification scanner. Option D is wrong because Purview Insights is a reporting feature.

Answer

Azure SQL Scanner (Purview)

Answer

Purview Insights

Answer

Microsoft Defender for SQL

Question 10

Which TWO actions should you take to secure an Azure Kubernetes Service (AKS) cluster using Microsoft Defender for Cloud?

Accepted Answer

Apply built-in Azure Policy initiatives for AKS. Options A and D are correct because enabling Defender for Containers provides threat detection, and Azure Policy with built-in AKS policies ensures compliance. Option B is wrong because AKS does not support NSGs; network policies are used. Option C is wrong because Azure Firewall is not required for AKS security. Option E is wrong because private clusters limit public access but are not a Defender feature.

Answer

Enable private cluster mode

Answer

Configure Network Security Groups (NSGs) on AKS subnets

Answer

Deploy Azure Firewall in the AKS virtual network

Question 11

Which THREE components are required to implement a Zero Trust network architecture using Microsoft Entra Internet Access (formerly Microsoft 365 Network Connectivity)?

Accepted Answer

Conditional Access policies. Options A, B, and D are correct because Entra Internet Access, Conditional Access, and Intune compliance are core Zero Trust components. Option C is wrong because VPN is traditional perimeter security. Option E is wrong because Azure AD Application Proxy (now Entra Application Proxy) is for legacy app publishing.

Answer

Azure AD Application Proxy

Answer

Site-to-site VPN

Question 12

Which TWO Azure services should you use to implement a defense-in-depth strategy for protecting Azure virtual machines?

Accepted Answer

Network Security Groups (NSGs). Options A and D are correct because NSGs provide network segmentation and Azure Backup provides data protection. Option B is wrong because Azure Front Door is for global load balancing. Option C is wrong because Azure Logic Apps is an integration service. Option E is wrong because Azure Automation is for process automation.

Answer

Azure Logic Apps

Answer

Azure Automation

Answer

Azure Front Door

Question 13

You are designing a hybrid identity solution for an organization that uses Microsoft Entra ID and an on-premises Active Directory. The organization requires that users who are located in a remote office without a direct VPN connection to the main office can authenticate against on-premises resources using their Entra ID credentials. The solution must minimize latency and support passwordless authentication. Which feature should you implement?

Accepted Answer

Implement Microsoft Entra Kerberos authentication. Option C is correct because Microsoft Entra Kerberos authentication enables users to access on-premises resources using their Entra ID credentials without requiring a VPN, and it supports passwordless methods like FIDO2 and Windows Hello for Business. Option A is wrong because Entra ID Application Proxy is for publishing on-premises web apps, not general authentication. Option B is wrong because Entra Connect Sync synchronizes identities but does not provide real-time authentication without VPN. Option D is wrong because Entra ID Conditional Access policies control access but do not enable passwordless authentication.

Answer

Configure Microsoft Entra Application Proxy

Answer

Enable Microsoft Entra Conditional Access policies

Answer

Deploy Microsoft Entra Connect Sync with password hash synchronization

Question 14

Your organization is designing a secure network infrastructure for a multi-cloud environment that includes Azure, AWS, and on-premises datacenters. The security team requires that all traffic between these environments be inspected for threats and that any malicious traffic be automatically blocked. The solution must minimize complexity and use a single pane of glass for policy management. Which Azure service should you use as the central hub?

Accepted Answer

Azure Firewall. Option B is correct because Azure Firewall can be deployed as a central hub in a hub-and-spoke topology, providing network-level traffic inspection for Azure, on-premises (via ExpressRoute or VPN), and even AWS (via VPN or Azure Virtual WAN). It offers integrated threat intelligence and supports routing policies. Option A is wrong because Azure DDoS Protection only mitigates volumetric attacks, not traffic inspection. Option C is wrong because Network Security Groups (NSGs) provide basic filtering but lack advanced inspection and multi-cloud support. Option D is wrong because Azure Front Door is a global load balancer and web application firewall, not a network firewall for multi-cloud traffic.

Answer

Azure Front Door

Answer

Network Security Groups (NSGs)

Answer

Azure DDoS Protection

Question 15

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure resources. The security team wants to ensure that all virtual machines are covered by Defender for Cloud's vulnerability assessment capabilities. Which plan must be enabled?

Accepted Answer

Microsoft Defender for Servers Plan 2. Option D is correct because the Defender for Servers Plan 2 includes the integrated vulnerability assessment powered by Qualys or Microsoft Defender Vulnerability Management. Option A is wrong because Defender CSPM covers cloud security posture management but not VM-specific vulnerability assessment. Option B is wrong because Defender for Cloud Apps (now part of Defender XDR) focuses on SaaS applications. Option C is wrong because Defender for Storage protects storage accounts.

Answer

Microsoft Defender for Storage

Answer

Microsoft Defender for Cloud Apps

Answer

Defender Cloud Security Posture Management (CSPM)