SC-100 Design security solutions for infrastructure Practice Test 3 — 15 Questions

Question 1

Your organization is migrating on-premises Active Directory to Microsoft Entra ID. You need to ensure that users can authenticate to on-premises resources using their Entra ID credentials. Which feature should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Pass-through Authentication. Pass-through Authentication with Seamless Single Sign-On (SSO) allows users to authenticate to on-premises resources using their Microsoft Entra ID credentials. It validates passwords against on-premises Active Directory, enabling the same credentials to be used for both cloud and on-premises access without syncing password hashes. Password Hash Sync (Option B) only enables cloud authentication and does not directly support on-premises resource access. AD FS (Option A) relies on an on-premises identity provider and does not use Entra ID credentials directly. Entra Connect Health (Option C) is a monitoring tool, not an authentication mechanism.

Answer

Active Directory Federation Services (AD FS)

Answer

Password Hash Sync with Microsoft Entra Connect

Answer

Microsoft Entra Connect Health

Question 2

You are designing a secure access solution for an Azure App Service web application that authenticates users via Microsoft Entra ID. The requirements include: only allowing users from a specific Entra ID tenant, and blocking access from certain countries. Which two features should you combine? (Choose two.)

Accepted Answer

App Service authentication with Microsoft Entra ID. Option A is correct because App Service authentication (Easy Auth) with Microsoft Entra ID is the built-in feature that federates the web app to a specific Entra ID tenant, ensuring only users from that tenant can authenticate and receive a valid token. Option E is correct because Azure Front Door's geo-filtering (WAF custom rules based on the GeoMatch condition) operates at the edge and can allow or block client requests by country before they reach the App Service. NSGs (B) only filter IP traffic at the network layer for subnets/NICs and cannot enforce Entra ID tenant-based user authentication. Managed Identity (D) provides an app with an identity to access other Azure resources, not to authenticate inbound end users. Microsoft Entra Conditional Access (C) is a policy engine for controlling access to cloud apps based on signals like location and device, but for an App Service web app the tenant restriction and country blocking are achieved through App Service authentication plus Front Door geo-filtering, and Conditional Access alone does not provide the edge geo-blocking required here.

Answer

Network Security Groups (NSGs)

Answer

Microsoft Entra Conditional Access

Answer

Managed Identity

Question 3

Your company uses Azure Backup to protect VMs. You need to ensure that backup data is encrypted at rest and during transit. Which features should you enable? (Choose three.)

Accepted Answer

Azure Disk Encryption (BitLocker/DM-Crypt). Azure Backup provides encryption at rest via Storage Service Encryption (SSE) or customer-managed keys (Option B), and encryption in transit via HTTPS (Option C). Additionally, Azure Disk Encryption (Option A) encrypts the source VM disks, ensuring that backup data is also encrypted at rest on the source. Soft delete (Option E) protects against accidental deletion but does not encrypt data. Azure Information Protection (Option D) is for data classification and labeling, not backup encryption. Therefore, the correct three features are A, B, and C.

Answer

Azure Information Protection

Answer

Soft delete for Azure Backup

Question 4

Refer to the exhibit. You review a PowerShell script that configures an NSG rule. What is the likely security issue with this rule?

Accepted Answer

The destination address prefix is 'VirtualNetwork' which allows traffic to all VMs. The rule allows HTTP (port 80) from the Internet to the VirtualNetwork address prefix, which effectively allows inbound traffic from any public IP to all VMs in the virtual network on port 80. This is overly permissive. Option A is wrong because the source address prefix is 'Internet', which is overly broad; it should be a specific IP range for proper security. Option B is wrong because the rule allows HTTP (port 80), not HTTPS. Option C is wrong because the rule is inbound, not outbound.

Answer

The source address prefix should be a specific IP range

Answer

The rule allows HTTPS instead of HTTP

Answer

The rule is outbound but should be inbound

Question 5

Refer to the exhibit. A KQL query in Microsoft Sentinel is used to detect potential brute-force attacks. What does this query detect?

Accepted Answer

Successful remote logon attempts from a single IP exceeding 10. Option C is correct because the query is designed to flag successful remote logon attempts originating from a single IP address when the count exceeds 10, which is the classic pattern of a brute-force attack that has succeeded. The threshold of 10 and the focus on successful remote logons distinguish it from generic failure monitoring. Options A and D are incorrect because they describe local logons or failed attempts from a single IP, which the query does not target. Option B is incorrect because it refers to failed logon attempts from multiple IPs, whereas the query keys on a single IP and successful logons.

Answer

Local logon attempts from multiple accounts

Answer

Failed logon attempts from multiple IPs

Answer

Failed logon attempts from a single IP

Question 6

A company is designing a security solution for their hybrid infrastructure that includes on-premises servers and Azure virtual machines. They need to ensure that all administrative access to servers is just-in-time (JIT) and just-enough-administration (JEA). Which Azure service should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides JIT VM access and JEA capabilities through Azure Arc for on-premises servers, making it the correct choice. Microsoft Entra Privileged Identity Management (PIM) is for user roles, not server access. Azure Bastion provides secure RDP/SSH access but not JIT. Azure Policy is for compliance, not JIT access.

Answer

Azure Bastion

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Azure Policy

Question 7

A global enterprise uses Azure Firewall and Azure Virtual Network Manager (AVNM) to manage network security. They want to deploy a new spoke virtual network that must be isolated from all other spokes except one specific shared services hub. The hub uses Azure Firewall to inspect traffic. What is the most secure and scalable way to enforce this isolation?

Accepted Answer

Use AVNM to create a network group for the new spoke and apply security admin rules to block inter-spoke traffic except to the hub.. Using AVNM connectivity and security admin rules allows central management of network groups and firewall policies, ensuring isolation while scaling. Direct peering with route tables is less scalable and lacks central management. NSG on the subnet is not scalable and can be overridden. Enforcing via Azure Policy with deny is possible but less integrated for network topology.

Answer

Apply a custom Azure Policy definition that denies VNet peering between the new spoke and any VNet other than the hub.

Answer

Configure direct VNet peering between the new spoke and the hub, and use route tables to block traffic to other spokes.

Answer

Deploy a network virtual appliance (NVA) in the new spoke and route all traffic through it.

Question 8

A company plans to migrate their on-premises Active Directory to Microsoft Entra ID. They need to ensure that legacy applications using NTLM authentication continue to work during the transition. What should they configure?

Accepted Answer

Microsoft Entra Connect with PTA and enable NTLM support for on-premises applications. Microsoft Entra Connect syncs identities and can be configured to allow NTLM authentication for hybrid identities. PTA or ADFS are for authentication, but not specifically for NTLM support. PHS alone doesn't handle NTLM. Cloud Kerberos trust is for Kerberos, not NTLM.

Answer

Microsoft Entra Connect with password hash synchronization (PHS) and seamless single sign-on (SSO)

Answer

Microsoft Entra Connect with Active Directory Federation Services (AD FS)

Answer

Microsoft Entra Connect with pass-through authentication (PTA)

Question 9

A multinational corporation is designing a secure infrastructure for their Azure Kubernetes Service (AKS) clusters. They require network policies to restrict pod-to-pod communication based on namespaces and label selectors. They also need to integrate with Azure Policy for compliance. Which network policy engine should they use?

Accepted Answer

Calico through Azure Policy add-on. Azure Policy for AKS supports the Calico network policy engine for advanced network policies. Cilium is not natively integrated with Azure Policy. Azure Firewall is for cluster ingress/egress, not pod-level policies. kubenet is a basic networking plugin that does not support network policies.

Answer

kubenet

Answer

Cilium

Answer

Azure Firewall

Question 10

Which TWO actions should you take to secure Azure SQL Database against SQL injection attacks?

Accepted Answer

Enable Azure Web Application Firewall (WAF) on Application Gateway. Using parameterized queries in stored procedures prevents SQL injection by separating SQL code from data. Enabling Azure WAF on Application Gateway filters malicious requests at the network edge. Row-Level Security is for access control, not injection. Always Encrypted protects data at rest. Dynamic Data Masking obfuscates data.

Answer

Implement Always Encrypted

Answer

Enable Row-Level Security (RLS)

Answer

Apply Dynamic Data Masking

Question 11

Which THREE components are required to implement a zero-trust network architecture in Azure using Microsoft security solutions?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Entra Conditional Access enforces access policies. Microsoft Defender for Cloud Apps provides cloud access security broker (CASB) functionality. Azure Policy ensures compliance. Azure Bastion is for secure connectivity. Microsoft Sentinel is for SIEM, not a core zero-trust component.

Answer

Microsoft Sentinel

Answer

Azure Bastion

Question 12

Which ONE Azure service can be used to protect a virtual network from inbound DDoS attacks at the network layer?

Accepted Answer

Azure DDoS Protection Standard. Azure DDoS Protection Standard is the dedicated service for mitigating volumetric DDoS attacks at the network layer (L3/L4). It automatically monitors and scrubs traffic to protect virtual networks. Other services like Azure Firewall operate at higher layers or are not primary DDoS solutions; Azure Firewall may filter traffic but does not provide specialized DDoS mitigation. Therefore, only Azure DDoS Protection Standard is designed for network-layer DDoS protection.

Answer

Azure Web Application Firewall (WAF)

Answer

Azure Traffic Manager

Answer

Network Security Groups (NSGs)

Answer

Azure Firewall

Question 13

Refer to the exhibit. An administrator is reviewing a just-in-time (JIT) access request in Microsoft Entra Privileged Identity Management (PIM) for Azure resources. The request was approved. What does the roleDefinitionId 'b24988ac-6180-42a0-ab88-20f7382dd24c' correspond to?

Accepted Answer

Storage Account Contributor. The roleDefinitionId 'b24988ac-6180-42a0-ab88-20f7382dd24c' is the GUID for the 'Storage Account Contributor' role in Azure RBAC. This is a built-in role that allows management of storage accounts, including access to storage account keys. The request is for temporary access to a storage account, and the role provides the necessary permissions.

Answer

Storage Blob Data Contributor

Answer

Contributor

Answer

Reader

Question 14

Refer to the exhibit. An administrator is deploying an Azure Firewall using the ARM template snippet. After deployment, traffic from the 10.0.0.0/16 subnet to www.microsoft.com on HTTPS is allowed. What is a potential security issue with this configuration?

Accepted Answer

Allowing HTTP (port 80) to *.microsoft.com is unnecessary and could be exploited. The rule allows HTTP (port 80) to *.microsoft.com, which is unnecessary and could allow unencrypted traffic. HTTPS (port 443) is sufficient. Allowing HTTP could expose traffic to interception. Additionally, the rule allows all *.microsoft.com subdomains, which might be overly permissive, but the main issue is the inclusion of HTTP.

Answer

The priority of 100 is too high and could override other rules

Answer

The firewall SKU tier should be Premium for better security

Answer

The source address range is too broad

Question 15

Your company uses Microsoft Intune to manage devices. You need to ensure that corporate data is wiped from a device if it reports a jailbroken status. What is the best approach?

Accepted Answer

Create a device compliance policy that marks jailbroken devices as noncompliant, then use Conditional Access to require compliance. The correct option is A: create a device compliance policy that marks jailbroken devices as noncompliant, then use Conditional Access to require compliance. Intune compliance policies include a jailbreak/rooted detection setting for iOS/iPadOS and Android, and Conditional Access can then block or force remediation of noncompliant devices, which is the supported way to act on jailbreak status. Option B is wrong because remote wipe is a manual, admin-triggered action and does not automatically wipe corporate data based on jailbreak detection. Option C is wrong because app protection policies can wipe app-level corporate data on jailbroken devices only when configured with the conditional launch jailbreak check, but the question asks for the best approach to wipe corporate data based on device compliance, which is the compliance policy plus Conditional Access. Option D is wrong because a device configuration policy enforces settings and cannot itself mark a device noncompliant or trigger a wipe.

Answer

Use the remote wipe action from Intune when a jailbreak is reported

Answer

Deploy an app protection policy that wipes data if jailbreak is detected

Answer

Configure a device configuration policy to block jailbroken devices