SC-100 Design security solutions for infrastructure Practice Test 3 — 15 Questions

Question 1

Your organization is deploying Azure Kubernetes Service (AKS) and plans to use Azure Policy to enforce security controls on the cluster. The security team wants to automatically audit and deny the creation of privileged containers. Which Azure Policy initiative should you assign?

Accepted Answer

Azure Policy for Kubernetes (preview). Option A is correct because the Azure Policy for Kubernetes initiative (preview) includes built-in policies to enforce security constraints like preventing privileged containers. Option B is wrong because Defender for Cloud's workload protection provides monitoring but not policy enforcement. Option C is wrong because Azure RBAC roles control permissions, not container security. Option D is wrong because AKS Pod Identity is for pod authentication to Azure resources.

Answer

Azure RBAC roles for AKS

Answer

Microsoft Defender for Containers

Answer

AKS Pod Identity

Question 2

You are designing a secure access solution for an on-premises application that uses legacy authentication protocols. The organization plans to migrate to Microsoft Entra ID but the application vendor has not yet provided a modern authentication update. The solution must enable single sign-on (SSO) and support multifactor authentication (MFA) for this application without modifying the application code. Which approach should you recommend?

Accepted Answer

Deploy Microsoft Entra Application Proxy with pre-authentication. Option C is correct because Microsoft Entra Application Proxy allows publishing on-premises apps with legacy authentication, and it can integrate with Entra ID for pre-authentication, enabling SSO and MFA without code changes. Option A is wrong because Entra ID Conditional Access policies require modern authentication to enforce MFA. Option B is wrong because the Microsoft Authentication Library (MSAL) requires app code changes. Option D is wrong because federation with ADFS still requires modern auth at the app level.

Answer

Integrate the application with the Microsoft Authentication Library (MSAL)

Answer

Federate the on-premises Active Directory with Microsoft Entra ID

Answer

Use Microsoft Entra Conditional Access policies to require MFA

Question 3

Your organization uses Microsoft Intune to manage endpoints. The security team wants to ensure that devices that cannot be enrolled in Intune (e.g., unmanaged BYOD devices) are still subject to security policies when accessing corporate resources. Which Microsoft Entra ID feature should you use?

Accepted Answer

Microsoft Entra Conditional Access policies. Option B is correct because Microsoft Entra Conditional Access policies can enforce access controls based on device compliance, including requiring MFA or blocking access from unmanaged devices. Option A is wrong because Intune enrollment is only for managed devices. Option C is wrong because Microsoft Defender for Endpoint (now part of Defender XDR) provides threat detection but not access policy enforcement. Option D is wrong because Windows Defender Application Control is for code integrity on managed devices.

Answer

Microsoft Intune enrollment policies

Answer

Windows Defender Application Control

Answer

Microsoft Defender for Endpoint

Question 4

You are designing a security solution for a critical Azure SQL Database that must be protected against data exfiltration by a compromised admin account. The solution must ensure that even a database administrator cannot copy data to an external storage account. Which Azure service should you configure?

Accepted Answer

Microsoft Purview Data Loss Prevention. Option D is correct because Microsoft Purview Data Loss Prevention (DLP) policies can be applied to Azure SQL Database to detect and block sensitive data exfiltration attempts. Option A is wrong because Azure SQL Database firewall controls network access, not data exfiltration. Option B is wrong because Always Encrypted protects data at rest and in use but does not prevent copying. Option C is wrong because Azure Information Protection (now integrated into Purview) is for classification and labeling, not real-time blocking.

Answer

Always Encrypted

Answer

Azure SQL Database firewall rules

Answer

Azure Information Protection

Question 5

Your organization is planning to use Microsoft Sentinel for security information and event management (SIEM). The security team wants to ensure that Sentinel can ingest logs from on-premises servers that are not connected to the internet. The solution must use Azure Arc for management. Which data connector should you use?

Accepted Answer

Azure Monitor Agent. Option A is correct because the Azure Monitor Agent (AMA) can be deployed via Azure Arc to on-premises servers, collecting logs and forwarding them to Sentinel via a Log Analytics workspace. Option B is wrong because the Log Analytics agent (MMA) is being deprecated. Option C is wrong because the Syslog connector typically requires direct connectivity or a forwarder. Option D is wrong because the Common Event Format (CEF) connector also requires a forwarder with internet access.

Answer

Common Event Format (CEF) via AMA

Answer

Syslog via AMA

Answer

Log Analytics agent (MMA)

Question 6

Which TWO Azure services can you use to implement a zero-trust network architecture that verifies identity and device compliance before granting access to on-premises applications? (Choose two.)

Accepted Answer

Microsoft Entra Application Proxy. Option A is correct because Microsoft Entra Application Proxy provides pre-authentication and conditional access for on-premises apps. Option C is correct because Microsoft Entra ID Conditional Access evaluates user identity and device compliance before granting access. Option B is wrong because Azure Bastion provides secure RDP/SSH access to VMs, not to applications. Option D is wrong because Azure Firewall is a network firewall, not an identity-aware access control. Option E is wrong because VPN Gateway provides network-level connectivity without identity verification.

Answer

Azure VPN Gateway

Answer

Azure Firewall

Answer

Azure Bastion

Question 7

Which THREE components are required to implement a Microsoft Sentinel solution that collects security logs from a multi-cloud environment including AWS and Azure? (Choose three.)

Accepted Answer

Log Analytics workspace. Option A is correct because Log Analytics workspace is the data store for Sentinel. Option B is correct because the Azure Monitor Agent (AMA) collects logs from Azure VMs. Option D is correct because a data connector for AWS (e.g., AWS CloudTrail) is needed to ingest logs. Option C is not required because Sentinel itself is the SIEM, not a separate component. Option E is not required because Azure Arc is optional for non-Azure servers but not required for AWS logs.

Answer

Microsoft Sentinel solution

Answer

Azure Arc

Question 8

Which TWO of the following are valid methods to enforce multifactor authentication (MFA) for users accessing Microsoft 365 services? (Choose two.)

Accepted Answer

Per-user MFA in the Microsoft 365 admin center. Option A is correct because per-user MFA can be enabled in the Microsoft 365 admin center. Option C is correct because Conditional Access policies can require MFA based on conditions. Option B is wrong because security defaults enforce MFA for all users, but it is not a per-user method; it is a tenant-level setting. Option D is wrong because Privileged Identity Management (PIM) manages role activation, not MFA enforcement. Option E is wrong because Azure AD Identity Protection detects risk, but MFA enforcement is done via Conditional Access.

Answer

Privileged Identity Management (PIM)

Answer

Security defaults

Answer

Identity Protection policies

Question 9

You are designing a secure hybrid network architecture for a company that uses Azure and an on-premises datacenter. The company requires that all traffic between Azure and on-premises traverses Microsoft's backbone network and never the public internet. Additionally, the solution must provide automatic failover if the primary connection fails. Which Azure service should you include in the design?

Accepted Answer

Azure ExpressRoute with redundant circuits. Azure ExpressRoute with redundant circuits meets the requirement of using Microsoft's backbone and automatic failover. VPN Gateway uses the public internet. Azure Virtual WAN can use ExpressRoute but is not a direct answer. Azure Front Door is for global load balancing of web applications.

Answer

Azure Virtual WAN

Answer

Azure Front Door

Answer

Azure VPN Gateway

Question 10

A company is planning to deploy a multi-tier application in Azure. The web tier must be accessible from the internet, while the database tier must be accessible only from the web tier and management jump boxes. The solution should minimize exposure to the internet. Which Azure architecture should you recommend?

Accepted Answer

Deploy Azure Firewall in a hub virtual network and peer spoke virtual networks for each tier, routing traffic through the firewall.. Azure Firewall in a hub virtual network with forced tunneling through a firewall provides centralized control and minimizes exposure. NSGs cannot inspect traffic, and Application Gateway alone does not restrict database access. VNet peering without firewall does not enforce inspection.

Answer

Use Azure Bastion for management and VNet peering between web and database subnets.

Answer

Place web and database tiers in the same virtual network and use Network Security Groups (NSGs) to restrict access.

Answer

Use Azure Application Gateway to expose the web tier and place the database tier in a separate subnet with a deny-all NSG.

Question 11

Your company has a Microsoft Defender for Cloud environment with Azure Arc-enabled on-premises servers. The security team wants to ensure that all servers have the Log Analytics agent installed and that missing updates are automatically remediated for critical vulnerabilities. Which policy initiative should you assign to the management group containing these servers?

Accepted Answer

Azure Security Benchmark. The Azure Security Benchmark initiative includes policies for agent installation and vulnerability remediation. The other options are either not policy initiatives or focus on different aspects like container security or regulatory compliance.

Answer

Azure Policy for Kubernetes

Answer

CIS Microsoft Azure Foundations Benchmark

Answer

NIST SP 800-53 R5

Question 12

A multinational corporation is designing a secure access solution for remote employees using company-managed devices. The solution must enforce device compliance before granting access to corporate resources, support single sign-on (SSO) for SaaS applications, and provide conditional access policies based on risk. Which combination of Microsoft security products should you recommend?

Accepted Answer

Microsoft Intune + Microsoft Entra ID + Microsoft Defender for Cloud Apps. Microsoft Intune provides device compliance, Microsoft Entra ID provides SSO and conditional access, and Microsoft Defender for Cloud Apps provides risk-based access control. The other combinations miss key components.

Answer

Microsoft Intune + Microsoft Defender for Endpoint + Microsoft Sentinel

Answer

Microsoft Entra ID + Microsoft Defender for Cloud Apps + Microsoft Purview

Answer

Microsoft Configuration Manager + Microsoft Entra ID + Microsoft Defender for Identity

Question 13

Your organization is implementing a zero-trust network strategy. You need to ensure that all network traffic between Azure virtual machines is encrypted and authenticated at the IP layer, regardless of the virtual network they are in. Which Azure feature should you configure?

Accepted Answer

Azure Virtual Network encryption. Azure Virtual Network encryption provides IPsec encryption for traffic between VMs within the same virtual network or peered virtual networks. Service endpoints use public IPs. Private Link is for accessing PaaS services privately. VPN Gateway is for site-to-site.

Answer

Azure Service Endpoints

Answer

Azure VPN Gateway

Answer

Azure Private Link

Question 14

Refer to the exhibit. You are reviewing an Azure Policy definition that is assigned to a subscription. What is the primary effect of this policy?

Accepted Answer

It modifies the OS disk to use a specific disk encryption set.. The policy uses the 'modify' effect to add or replace the disk encryption set ID on any virtual machine's OS disk managed disk. This ensures VMs use a specific encryption set. 'deployIfNotExists' would deploy a resource, 'audit' would only log, 'deny' would block creation.

Answer

It deploys a disk encryption set to each virtual machine.

Answer

It denies creation of virtual machines without the specified disk encryption set.

Answer

It audits virtual machines that do not use the specified disk encryption set.

Question 15

Your company uses Microsoft Sentinel as its SIEM. You need to design a solution to detect lateral movement attempts within the corporate network using Windows Event Logs collected from domain controllers and workstations. Which data source and analytic rule type should you use?

Accepted Answer

Windows Security Events with a Fusion rule. Windows Security Events from domain controllers and workstations, with a Fusion or multi-event analytic rule, can detect lateral movement patterns like pass-the-hash. Sysmon is useful but not the only source. Scheduled query rules are for single events. Anomaly rules use machine learning but may not be as precise.

Answer

Azure Activity logs with an anomaly rule

Answer

Windows Security Events with a scheduled query rule

Answer

Sysmon logs with a scheduled query rule