SC-100 Design security solutions for infrastructure Practice Test 2 — 15 Questions

Question 1

You need to secure Azure Kubernetes Service (AKS) clusters by ensuring that only approved container images from a private Azure Container Registry (ACR) can be deployed. The solution should enforce this at admission time. Which Azure Policy effect should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

enforceRegoPolicy. The 'enforceRegoPolicy' effect for Azure Policy on AKS uses Open Policy Agent (OPA) Gatekeeper to enforce that only images from specific registries are allowed. 'audit' only logs, 'deny' is not directly applicable for AKS admission, 'modify' changes resources but does not block.

Answer

modify

Answer

audit

Answer

deny

Question 2

You are designing a secure access strategy for Azure SQL Database. The solution must use Microsoft Entra authentication and ensure that only specific client IP addresses can connect. Additionally, all connections must be encrypted in transit. Which THREE components should you configure?

Accepted Answer

Microsoft Entra authentication for the SQL server. Microsoft Entra authentication is required for identity-based access. A server-level firewall rule allows specific IPs. Enforcing TLS 1.2 ensures encryption in transit. Private endpoint is not required for IP-based filtering. Microsoft Entra ID admin is a user, not a component. Always Encrypted is for column-level encryption, not network security.

Answer

Enable Always Encrypted for sensitive columns

Answer

Configure an Azure Private Endpoint for the SQL server

Question 3

Your company uses Microsoft Defender for Endpoint and Microsoft Intune to manage endpoints. You need to ensure that devices are healthy before they can access corporate resources. Which TWO settings should you configure in Microsoft Intune compliance policies to enforce device health?

Accepted Answer

Require device encryption (BitLocker) on Windows devices. Requiring antivirus (Windows Defender) to be active ensures protection against malware. Requiring encryption (BitLocker) protects data at rest on lost devices. Password length and OS version are important but not the most direct health checks for threat protection. Jailbreak detection is for mobile devices.

Answer

Require a minimum password length of 8 characters

Answer

Require that the device is not jailbroken or rooted

Answer

Require the device to be on a specific OS version

Question 4

Refer to the exhibit. You are reviewing a PowerShell script that configures network security. What is the effect of the NSG rule created in this script?

Accepted Answer

It blocks all inbound traffic from the internet to the subnet.. The rule denies all inbound traffic from the 'Internet' service tag to all ports and protocols. 'Internet' includes traffic from outside Azure. The rule is applied at the subnet level. It does not affect outbound traffic, nor traffic from other Azure services unless they originate from the internet.

Answer

It blocks all outbound traffic to the internet from the subnet.

Answer

It blocks inbound traffic only from specific IP ranges.

Answer

It allows inbound traffic from the internet, then denies it.

Question 5

Refer to the exhibit. You are reviewing an ARM template for an Azure App Service configuration. What is the effect of the ipSecurityRestrictions array?

Accepted Answer

It allows traffic from 192.168.0.0/24 and denies all other traffic.. The rules are evaluated in priority order. The first rule allows traffic from 192.168.0.0/24. The second rule denies all other traffic (Any). This effectively restricts access to only the specified corporate IP range. The order matters because if the deny rule had lower priority, it would block the allowed range.

Answer

It allows all traffic because the deny rule has a higher priority number.

Answer

It denies traffic from 192.168.0.0/24 and allows all other traffic.

Answer

It denies all traffic because the deny rule covers any IP.

Question 6

Your organization has deployed Microsoft Defender for Cloud with the CSPM (Cloud Security Posture Management) plan enabled. You need to ensure that all Azure subscriptions are covered and that security recommendations are automatically remediated for critical findings. Which two actions should you take? (Choose two.)

Accepted Answer

Enable Microsoft Defender for Cloud on all subscriptions.. Enabling Microsoft Defender for Cloud on all subscriptions (A) ensures that every subscription is monitored and assessed for security posture. Configuring automatic provisioning of the Log Analytics agent (C) allows Defender for Cloud to collect necessary data from Azure resources, which enables it to evaluate security configurations and automatically apply remediation for certain critical findings (e.g., via built-in auto-remediation settings). Option B configures notifications but does not affect remediation or coverage. Option D is incorrect because the 'Auto Remediate' toggle is per-recommendation and not a global setting for all recommendations. Option E is a valid method for custom remediation using Azure Policy, but it is not required; Defender for Cloud's built-in capabilities suffice for automatic remediation of many critical findings. Therefore, the two required actions are A and C.

Answer

Configure security contact details for each subscription.

Answer

Set the 'Auto Remediate' toggle to 'On' for all security recommendations.

Answer

Create Azure Policy assignments with 'deployIfNotExists' effect to auto-remediate critical findings.

Question 7

Refer to the exhibit. You are designing a security solution for Azure SQL Database. The exhibit shows an Azure Policy definition. When this policy is assigned, which problem might occur?

Accepted Answer

The remediation deployment will fail because the storage account key is missing.. The correct answer is B: the remediation deployment will fail because the storage account key is missing. In an Azure Policy with a deployIfNotExists effect that configures SQL auditing, the remediation template typically requires the storage account key (for example, via a parameter such as storageAccountKey or a listKeys reference) to enable auditing to write audit logs to the storage account; if that key is not supplied or resolved, the remediation deployment fails. Option A is incorrect because 'default' is the valid resource name for the SQL auditing settings resource. Option C is incorrect because the existenceCondition field name is not misspelled in the exhibit. Option D is incorrect because a deployIfNotExists policy performs remediation, not audit-only behavior.

Answer

The policy will fail because the audit settings resource name 'default' is invalid.

Answer

The existenceCondition will never evaluate to true because the field name is misspelled.

Answer

The policy will only audit non-compliant servers without remediation.

Question 8

A company uses Azure Firewall to protect their virtual network. They need to allow outbound HTTPS traffic to a specific external website while blocking all other outbound traffic. What should they configure?

Accepted Answer

Add an Application Rule with the destination FQDN of the website.. Application Rules filter outbound traffic based on FQDN (e.g., *.contoso.com). Option B is wrong because Network Rules filter based on IP addresses/ports, not FQDNs. Option C is wrong because Threat Intelligence rules block known malicious IPs/FQDNs, not allow specific ones. Option D is wrong because DNAT rules are for inbound traffic.

Answer

Add a Network Rule with the destination IP address and port 443.

Answer

Add a Threat Intelligence rule to allow the website's domain.

Answer

Add a DNAT Rule to translate the traffic to the website's IP.

Question 9

Refer to the exhibit. You run the PowerShell script to check compliance of the 'RequireSQLEncryption' policy assignment. The script returns no output. What is the most likely reason?

Accepted Answer

All resources are compliant, so the Where-Object filter returns empty.. The script uses Get-AzPolicyState to retrieve policy states and then filters for non-compliant resources with Where-Object. If there are no non-compliant resources, the Where-Object filter returns empty, resulting in no output. Option C correctly identifies this as the most likely reason, as it is a common scenario when policies are compliant. Option A is incorrect because Get-AzPolicyState is a valid Azure PowerShell cmdlet. Option B is incorrect because the script does not depend on management group scope for output. Option D is less likely because even without resources, the cmdlet would still execute, but the filter would still be empty.

Answer

The Get-AzPolicyState cmdlet is not a valid Azure PowerShell cmdlet; it should be Get-AzPolicyStateSummary.

Answer

The policy assignment is scoped to a management group, not a resource group.

Answer

There are no resources in the resource group InfrastructureRG.

Question 10

Refer to the exhibit. You run the PowerShell script to apply an NSG to a subnet. However, connectivity tests show that the NSG rule is not being applied. What is the most likely reason?

Accepted Answer

The script is missing the Set-AzVirtualNetwork call after updating the subnet.. The correct answer is B: the script is missing the Set-AzVirtualNetwork call after updating the subnet. In Azure PowerShell, Set-AzVirtualNetworkSubnetConfig only modifies the in-memory subnet object; the change must be committed to Azure by piping the updated virtual network object to Set-AzVirtualNetwork, so without that call the NSG association is never persisted and the rule is not applied. Option A is incorrect because Set-AzVirtualNetworkSubnetConfig is the correct cmdlet for attaching an NSG to a subnet, provided the change is then committed. Option C is wrong because priority 100 is the highest priority and would be evaluated first, not blocked by a lower-priority rule. Option D is wrong because NSGs can be associated with either a subnet or a NIC, and subnet association is valid.

Answer

The NSG was not associated to the subnet; Set-AzVirtualNetworkSubnetConfig does not associate the NSG.

Answer

The rule priority 100 conflicts with an existing rule with lower priority.

Answer

The NSG should be associated to the network interface instead of the subnet.

Question 11

You need to secure Azure Blob Storage by encrypting data at rest using customer-managed keys stored in Azure Key Vault. What should you configure?

Accepted Answer

Configure encryption with customer-managed keys in Azure Key Vault and enable infrastructure encryption.. Azure Storage Service Encryption is always on for data at rest, but to use customer-managed keys (CMK) you must configure the storage account to reference a key stored in Azure Key Vault (or Managed HSM), and enabling infrastructure encryption adds a second layer of encryption at the infrastructure level. This combination satisfies the requirement of encrypting blob data at rest with keys the customer controls. The storage account's managed identity or the configuring user needs appropriate Key Vault permissions (wrapkey/unwrapkey/get).

Answer

Enable Azure Purview to manage encryption keys.

Answer

Enable Azure Disk Encryption for the storage account.

Answer

Enable Azure Information Protection for the storage account.

Question 12

Which THREE components are required to implement a secure Azure DevOps CI/CD pipeline that scans for secrets in code? (Choose three.)

Accepted Answer

GitHub Advanced Security for secret scanning.. Option B (GitHub Advanced Security for secret scanning) is correct because it provides native secret scanning in Azure DevOps repositories, detecting exposed credentials such as API keys and tokens in code and push history. Option C (Credential Scanner in Azure DevOps) is correct because the Credential Scanner (CredScan) task in a pipeline analyzes source code and build artifacts for hardcoded secrets and credentials as part of the CI/CD workflow. Option E (Azure Key Vault to store secrets used in pipelines) is correct because securely storing pipeline secrets in Key Vault, accessed via variable groups or Key Vault tasks, prevents secrets from being hardcoded in code or pipeline definitions, which is essential for a secure pipeline. Option A is not required because Azure Artifacts is a package feed for storing and sharing packages, not a secret-scanning or secret-management component. Option D is not required because Azure Boards is a work-tracking service for issues and backlogs, and while it can track remediation work, it is not a technical component needed to scan for secrets.

Answer

Azure Artifacts to store packages.

Answer

Azure Boards for tracking security issues.

Question 13

You are designing security for a multi-region Azure application. You need to ensure that traffic between virtual networks in different regions is encrypted and uses Microsoft backbone. What should you implement?

Accepted Answer

Deploy a site-to-site VPN between the virtual networks.. To encrypt traffic between VNets while keeping it on the Microsoft backbone, deploy a VNet-to-VNet site-to-site VPN (VPN gateways in each VNet configured as an S2S/VNet-to-VNet connection). This uses IPsec to encrypt the traffic and, since both endpoints are in Azure, the tunneled traffic traverses the Microsoft backbone. VNet peering itself provides private connectivity over the Microsoft backbone but no encryption; 'Allow gateway transit'/'Use remote gateways' only lets a peered VNet use the remote VPN gateway for connections to other networks, not for encrypting peering traffic. ExpressRoute is for connecting on-premises networks, and Azure Firewall inspects but does not encrypt transit.

Answer

Configure VNet peering with 'Allow gateway transit' and 'Use remote gateways'.

Answer

Use Azure Firewall in each VNet and route traffic through it.

Answer

Deploy ExpressRoute circuits and connect each VNet to them.

Question 14

You are designing a secure hybrid network architecture that connects an on-premises data center to Azure. The requirements include: encrypted traffic, high availability across two Azure regions, and automatic failover. You need to recommend a connectivity solution that meets these requirements. What should you use?

Accepted Answer

Azure ExpressRoute with VPN gateway failover. It combines a private, dedicated ExpressRoute circuit for encrypted, high-throughput connectivity with a Site-to-Site VPN gateway as a backup path, and by deploying the ExpressRoute circuits and VPN gateways in two Azure regions you achieve cross-region high availability with automatic failover. ExpressRoute supports private peering for on-premises-to-Azure VNet traffic, and the VPN gateway failover ensures connectivity continues if the primary ExpressRoute circuit degrades. Option A (Point-to-Site VPN) is a client-to-Azure solution, not suitable for data-center-to-Azure hybrid connectivity or multi-region HA. Option C (Site-to-Site VPN active-passive) provides encryption but only a single tunnel pair without the dedicated private circuit or the multi-region resilience ExpressRoute offers. Option D (ExpressRoute with Microsoft Peering) is used for Microsoft 365 and Azure public services, not for private VNet connectivity, and lacks the VPN failover requirement.

Answer

Azure Point-to-Site VPN

Answer

Azure Site-to-Site VPN with active-passive configuration

Answer

Azure ExpressRoute with Microsoft Peering

Question 15

Your company uses Azure DevOps to manage CI/CD pipelines. You need to ensure that secrets such as API keys are securely stored and automatically injected into pipeline tasks without being exposed in logs. What should you use?

Accepted Answer

Azure Key Vault linked to Azure DevOps. Azure Key Vault securely stores secrets and Azure DevOps can retrieve them without exposing secrets in logs. Option A is wrong because variable groups can store secrets but they are not as secure as Key Vault. Option C is wrong because Azure App Configuration is for application configuration, not secrets. Option D is wrong because Azure Policy is for governance, not secret management.

Answer

Azure DevOps variable groups

Answer

Azure App Configuration

Answer

Azure Policy