SC-100 Design security solutions for infrastructure Practice Test 3 — 15 Questions

Question 1

Your organization is planning to use Microsoft Sentinel for security information and event management (SIEM). The security team wants to ensure that Sentinel can ingest logs from on-premises servers that are not connected to the internet. The solution must use Azure Arc for management. Which data connector should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Monitor Agent. The Azure Monitor Agent (AMA) can be deployed via Azure Arc to on-premises servers, collecting logs and forwarding them to Sentinel via a Log Analytics workspace. Option B (Common Event Format via AMA) is wrong because the Common Event Format (CEF) connector requires a forwarder with internet access. Option C is wrong because the Syslog connector typically requires direct connectivity or a forwarder. Option D (Log Analytics agent) is wrong because the Log Analytics agent (MMA) is being deprecated.

Answer

Common Event Format (CEF) via AMA

Answer

Syslog via AMA

Answer

Log Analytics agent (MMA)

Question 2

Which TWO Azure services can you use to implement a zero-trust network architecture that verifies identity and device compliance before granting access to on-premises applications? (Choose two.)

Accepted Answer

Microsoft Entra Application Proxy. Microsoft Entra Application Proxy provides pre-authentication and conditional access for on-premises apps, ensuring identity and device compliance before access. Option B is correct because Microsoft Entra Conditional Access evaluates user identity, device compliance, and other conditions to enforce access policies. Option C is incorrect because Azure VPN Gateway provides network-level connectivity without identity verification. Option D is incorrect because Azure Firewall is a network firewall that filters traffic but does not verify identity or device compliance. Option E is incorrect because Azure Bastion provides secure RDP/SSH access to Azure VMs, not to on-premises applications.

Answer

Azure VPN Gateway

Answer

Azure Firewall

Answer

Azure Bastion

Question 3

Which THREE components are required to implement a Microsoft Sentinel solution that collects security logs from a multi-cloud environment including AWS and Azure? (Choose three.)

Accepted Answer

Log Analytics workspace. A Log Analytics workspace is the foundational data store for Microsoft Sentinel. Option C is correct because the Azure Monitor Agent (AMA) is required to collect security logs from Azure VMs and other sources. Option D is correct because an AWS S3 data connector is needed to ingest AWS CloudTrail logs into Sentinel. Option B is not required because Microsoft Sentinel is the overarching SIEM solution, not a separate component within it. Option E is not required because Azure Arc is an optional tool for managing non-Azure environments, not a mandatory component for AWS log collection.

Answer

Microsoft Sentinel solution

Answer

Azure Arc

Question 4

Which TWO of the following are valid methods to enforce multifactor authentication (MFA) for users accessing Microsoft 365 services? (Choose two.)

Accepted Answer

Per-user MFA in the Microsoft 365 admin center. Per-user MFA can be enabled in the Microsoft 365 admin center, requiring users to register for and use MFA. Option E is correct because Conditional Access policies can enforce MFA based on specific conditions such as location, device, or risk. Option A is incorrect because Privileged Identity Management (PIM) manages role activation and just-in-time access, not MFA enforcement. Option B is incorrect because Security defaults is a tenant-level setting that enforces MFA for all users, but it is not a method to enforce MFA per user or with granular conditions. Option C is incorrect because Identity Protection policies detect and respond to risks but do not directly enforce MFA; they can trigger Conditional Access policies for MFA, but the enforcement is done via Conditional Access, not Identity Protection itself.

Answer

Privileged Identity Management (PIM)

Answer

Security defaults

Answer

Identity Protection policies

Question 5

You are designing a secure hybrid network architecture for a company that uses Azure and an on-premises datacenter. The company requires that all traffic between Azure and on-premises traverses Microsoft's backbone network and never the public internet. Additionally, the solution must provide automatic failover if the primary connection fails. Which Azure service should you include in the design?

Accepted Answer

Azure ExpressRoute with redundant circuits. Azure ExpressRoute with redundant circuits meets the requirement of using Microsoft's backbone network and provides automatic failover. VPN Gateway (Option D) routes traffic over the public internet. Azure Virtual WAN (Option B) is a networking service that can use ExpressRoute but is not a direct answer for the specific requirement of a dedicated backbone connection with automatic failover. Azure Front Door (Option C) is a global load balancer for web applications and does not provide the required connectivity between Azure and on-premises.

Answer

Azure Virtual WAN

Answer

Azure Front Door

Answer

Azure VPN Gateway

Question 6

A company is planning to deploy a multi-tier application in Azure. The web tier must be accessible from the internet, while the database tier must be accessible only from the web tier and management jump boxes. The solution should minimize exposure to the internet. Which Azure architecture should you recommend?

Accepted Answer

Deploy Azure Firewall in a hub virtual network and peer spoke virtual networks for each tier, routing traffic through the firewall.. Azure Firewall in a hub virtual network with forced tunneling through a firewall provides centralized control and minimizes exposure. NSGs cannot inspect traffic, and Application Gateway alone does not restrict database access. VNet peering without firewall does not enforce inspection.

Answer

Use Azure Bastion for management and VNet peering between web and database subnets.

Answer

Place web and database tiers in the same virtual network and use Network Security Groups (NSGs) to restrict access.

Answer

Use Azure Application Gateway to expose the web tier and place the database tier in a separate subnet with a deny-all NSG.

Question 7

Your company has a Microsoft Defender for Cloud environment with Azure Arc-enabled on-premises servers. The security team wants to ensure that all servers have the Log Analytics agent installed and that missing updates are automatically remediated for critical vulnerabilities. Which policy initiative should you assign to the management group containing these servers?

Accepted Answer

Azure Security Benchmark. The Azure Security Benchmark initiative includes policies for agent installation and vulnerability remediation. The other options are either not policy initiatives or focus on different aspects like container security or regulatory compliance.

Answer

Azure Policy for Kubernetes

Answer

CIS Microsoft Azure Foundations Benchmark

Answer

NIST SP 800-53 R5

Question 8

A multinational corporation is designing a secure access solution for remote employees using company-managed devices. The solution must enforce device compliance before granting access to corporate resources, support single sign-on (SSO) for SaaS applications, and provide conditional access policies based on risk. Which combination of Microsoft security products should you recommend?

Accepted Answer

Microsoft Intune + Microsoft Entra ID + Microsoft Defender for Cloud Apps. Microsoft Intune provides device compliance, Microsoft Entra ID provides SSO and conditional access, and Microsoft Defender for Cloud Apps provides risk-based access control. The other combinations miss key components.

Answer

Microsoft Intune + Microsoft Defender for Endpoint + Microsoft Sentinel

Answer

Microsoft Entra ID + Microsoft Defender for Cloud Apps + Microsoft Purview

Answer

Microsoft Configuration Manager + Microsoft Entra ID + Microsoft Defender for Identity

Question 9

Your organization is implementing a zero-trust network strategy. You need to ensure that all network traffic between Azure virtual machines is encrypted and authenticated at the IP layer, regardless of the virtual network they are in. Which Azure feature should you configure?

Accepted Answer

Azure Virtual Network encryption. Azure Virtual Network encryption provides IPsec encryption for traffic between VMs within the same virtual network or peered virtual networks. Service endpoints use public IPs. Private Link is for accessing PaaS services privately. VPN Gateway is for site-to-site.

Answer

Azure Service Endpoints

Answer

Azure VPN Gateway

Answer

Azure Private Link

Question 10

Refer to the exhibit. You are reviewing an Azure Policy definition that is assigned to a subscription. What is the primary effect of this policy?

Accepted Answer

It modifies the OS disk to use a specific disk encryption set.. The policy uses the 'modify' effect to add or replace the disk encryption set ID on any virtual machine's OS disk managed disk. This ensures VMs use a specific encryption set. 'deployIfNotExists' would deploy a resource, 'audit' would only log, 'deny' would block creation.

Answer

It deploys a disk encryption set to each virtual machine.

Answer

It denies creation of virtual machines without the specified disk encryption set.

Answer

It audits virtual machines that do not use the specified disk encryption set.

Question 11

Your company uses Microsoft Sentinel as its SIEM. You need to design a solution to detect lateral movement attempts within the corporate network using Windows Event Logs collected from domain controllers and workstations. Which data source and analytic rule type should you use?

Accepted Answer

Windows Security Events with a Fusion rule. Windows Security Events from domain controllers and workstations, with a Fusion or multi-event analytic rule, can detect lateral movement patterns like pass-the-hash. Sysmon is useful but not the only source. Scheduled query rules are for single events. Anomaly rules use machine learning but may not be as precise.

Answer

Azure Activity logs with an anomaly rule

Answer

Windows Security Events with a scheduled query rule

Answer

Sysmon logs with a scheduled query rule

Question 12

You need to secure Azure Kubernetes Service (AKS) clusters by ensuring that only approved container images from a private Azure Container Registry (ACR) can be deployed. The solution should enforce this at admission time. Which Azure Policy effect should you use?

Accepted Answer

enforceRegoPolicy. The 'enforceRegoPolicy' effect for Azure Policy on AKS uses Open Policy Agent (OPA) Gatekeeper to enforce that only images from specific registries are allowed. 'audit' only logs, 'deny' is not directly applicable for AKS admission, 'modify' changes resources but does not block.

Answer

modify

Answer

audit

Answer

deny

Question 13

Your company is migrating to a cloud-native security operations center (SOC) using Microsoft Sentinel. You need to design a solution that automatically investigates and remediates common incidents like brute-force attacks on Azure VMs. The solution should use playbooks triggered by analytics rules. Which Microsoft service should you use to create the playbooks, and what is the recommended authentication method?

Accepted Answer

Azure Logic Apps with managed identity. Azure Logic Apps is the recommended platform for Sentinel playbooks. Managed identity is the preferred authentication method because it avoids credential management and supports automation. Azure Automation is for runbooks, not playbooks. Service principal is possible but not recommended due to credential management.

Answer

Power Automate with user account

Answer

Azure Automation with service principal

Answer

Azure Functions with API key

Question 14

A company is designing a secure baseline for Azure VMs using Azure Policy and Microsoft Defender for Cloud. Which TWO recommendations should you include to ensure VMs are protected against common threats?

Accepted Answer

Deploy the Log Analytics agent on all VMs. Enabling just-in-time (JIT) VM access reduces attack surface by blocking inbound traffic to management ports. Deploying the Log Analytics agent is required for Defender for Cloud to collect security data. The other options are either not security baselines or not VM-specific.

Answer

Configure Azure Backup for all VMs

Answer

Enable Azure Site Recovery

Answer

Use Azure Disk Encryption with Azure Key Vault

Question 15

You are designing a secure access strategy for Azure SQL Database. The solution must use Microsoft Entra authentication and ensure that only specific client IP addresses can connect. Additionally, all connections must be encrypted in transit. Which THREE components should you configure?

Accepted Answer

Microsoft Entra authentication for the SQL server. Microsoft Entra authentication is required for identity-based access. A server-level firewall rule allows specific IPs. Enforcing TLS 1.2 ensures encryption in transit. Private endpoint is not required for IP-based filtering. Azure AD admin is a user, not a component. Always Encrypted is for column-level encryption, not network security.

Answer

Enable Always Encrypted for sensitive columns

Answer

Configure an Azure Private Endpoint for the SQL server