SC-100 Design security solutions for infrastructure Practice Test 4 — 15 Questions

Question 1

You need to secure Azure Kubernetes Service (AKS) clusters by ensuring that only approved container images from a private Azure Container Registry (ACR) can be deployed. The solution should enforce this at admission time. Which Azure Policy effect should you use?

Accepted Answer

enforceRegoPolicy. The 'enforceRegoPolicy' effect for Azure Policy on AKS uses Open Policy Agent (OPA) Gatekeeper to enforce that only images from specific registries are allowed. 'audit' only logs, 'deny' is not directly applicable for AKS admission, 'modify' changes resources but does not block.

Answer

modify

Answer

audit

Answer

deny

Question 2

Your company is migrating to a cloud-native security operations center (SOC) using Microsoft Sentinel. You need to design a solution that automatically investigates and remediates common incidents like brute-force attacks on Azure VMs. The solution should use playbooks triggered by analytics rules. Which Microsoft service should you use to create the playbooks, and what is the recommended authentication method?

Accepted Answer

Azure Logic Apps with managed identity. Azure Logic Apps is the recommended platform for Sentinel playbooks. Managed identity is the preferred authentication method because it avoids credential management and supports automation. Azure Automation is for runbooks, not playbooks. Service principal is possible but not recommended due to credential management.

Answer

Power Automate with user account

Answer

Azure Automation with service principal

Answer

Azure Functions with API key

Question 3

A company is designing a secure baseline for Azure VMs using Azure Policy and Microsoft Defender for Cloud. Which TWO recommendations should you include to ensure VMs are protected against common threats?

Accepted Answer

Deploy the Log Analytics agent on all VMs. Enabling just-in-time (JIT) VM access reduces attack surface by blocking inbound traffic to management ports. Deploying the Log Analytics agent is required for Defender for Cloud to collect security data. The other options are either not security baselines or not VM-specific.

Answer

Configure Azure Backup for all VMs

Answer

Enable Azure Site Recovery

Answer

Use Azure Disk Encryption with Azure Key Vault

Question 4

You are designing a secure access strategy for Azure SQL Database. The solution must use Microsoft Entra authentication and ensure that only specific client IP addresses can connect. Additionally, all connections must be encrypted in transit. Which THREE components should you configure?

Accepted Answer

Microsoft Entra authentication for the SQL server. Microsoft Entra authentication is required for identity-based access. A server-level firewall rule allows specific IPs. Enforcing TLS 1.2 ensures encryption in transit. Private endpoint is not required for IP-based filtering. Azure AD admin is a user, not a component. Always Encrypted is for column-level encryption, not network security.

Answer

Enable Always Encrypted for sensitive columns

Answer

Configure an Azure Private Endpoint for the SQL server

Question 5

Your company uses Microsoft Defender for Endpoint and Microsoft Intune to manage endpoints. You need to ensure that devices are healthy before they can access corporate resources. Which TWO settings should you configure in Microsoft Intune compliance policies to enforce device health?

Accepted Answer

Require device encryption (BitLocker) on Windows devices. Requiring antivirus (Windows Defender) to be active ensures protection against malware. Requiring encryption (BitLocker) protects data at rest on lost devices. Password length and OS version are important but not the most direct health checks for threat protection. Jailbreak detection is for mobile devices.

Answer

Require a minimum password length of 8 characters

Answer

Require that the device is not jailbroken or rooted

Answer

Require the device to be on a specific OS version

Question 6

Refer to the exhibit. You are reviewing a PowerShell script that configures network security. What is the effect of the NSG rule created in this script?

Accepted Answer

It blocks all inbound traffic from the internet to the subnet.. The rule denies all inbound traffic from the 'Internet' service tag to all ports and protocols. 'Internet' includes traffic from outside Azure. The rule is applied at the subnet level. It does not affect outbound traffic, nor traffic from other Azure services unless they originate from the internet.

Answer

It blocks all outbound traffic to the internet from the subnet.

Answer

It blocks inbound traffic only from specific IP ranges.

Answer

It allows inbound traffic from the internet, then denies it.

Question 7

Refer to the exhibit. You are reviewing an ARM template for an Azure App Service configuration. What is the effect of the ipSecurityRestrictions array?

Accepted Answer

It allows traffic from 192.168.0.0/24 and denies all other traffic.. The rules are evaluated in priority order. The first rule allows traffic from 192.168.0.0/24. The second rule denies all other traffic (Any). This effectively restricts access to only the specified corporate IP range. The order matters because if the deny rule had lower priority, it would block the allowed range.

Answer

It allows all traffic because the deny rule has a higher priority number.

Answer

It denies traffic from 192.168.0.0/24 and allows all other traffic.

Answer

It denies all traffic because the deny rule covers any IP.

Question 8

Your organization has deployed Microsoft Defender for Cloud with the CSPM (Cloud Security Posture Management) plan enabled. You need to ensure that all Azure subscriptions are covered and that security recommendations are automatically remediated for critical findings. Which two actions should you take? (Choose two.)

Accepted Answer

Enable Microsoft Defender for Cloud on all subscriptions.. Enabling Defender for Cloud on all subscriptions ensures coverage. Configuring automatic provisioning of the Log Analytics agent ensures data collection. To auto-remediate, you need to use Azure Policy with 'deployIfNotExists' or 'modify' effects, not just enable Defender. The 'Auto Remediate' setting in Defender for Cloud applies only to certain recommendations, but for custom remediation, Azure Policy is needed. The security contacts are for notifications, not remediation.

Answer

Configure security contact details for each subscription.

Answer

Set the 'Auto Remediate' toggle to 'On' for all security recommendations.

Answer

Create Azure Policy assignments with 'deployIfNotExists' effect to auto-remediate critical findings.

Question 9

Your organization plans to use Microsoft Defender for Cloud to protect a hybrid environment with servers in Azure and on-premises. You need to ensure that security policies are consistently applied across all servers. What should you configure?

Accepted Answer

Onboard all servers to Azure Arc and assign Defender for Cloud policies.. Option D is correct because Azure Arc allows non-Azure servers to be managed with the same Azure Policy and Defender for Cloud policies as Azure VMs. Option A is wrong because Azure Automation State Configuration is for configuration management, not policy enforcement. Option B is wrong because Azure Policy guest configuration requires Azure Arc for non-Azure machines. Option C is wrong because Microsoft Sentinel is a SIEM, not a policy enforcement tool.

Answer

Deploy Azure Automation State Configuration (DSC) to all servers.

Answer

Connect all servers to Microsoft Sentinel and use analytics rules.

Answer

Use Azure Policy with guest configuration on all servers.

Question 10

Refer to the exhibit. You are designing a security solution for Azure SQL Database. The exhibit shows an Azure Policy definition. When this policy is assigned, which problem might occur?

Accepted Answer

The remediation deployment will fail because the storage account key is missing.. Option C is correct because the template uses a parameter for storageEndpoint but does not specify a storageAccountAccessKey or use a managed identity, so the audit logs cannot be written to the storage account. Option A is wrong because 'default' is the correct name for the audit settings child resource. Option B is wrong because the policy uses DeployIfNotExists, not AuditIfNotExists. Option D is wrong because the existenceCondition checks for 'Enabled', which is correct.

Answer

The policy will fail because the audit settings resource name 'default' is invalid.

Answer

The existenceCondition will never evaluate to true because the field name is misspelled.

Answer

The policy will only audit non-compliant servers without remediation.

Question 11

A company uses Azure Firewall to protect their virtual network. They need to allow outbound HTTPS traffic to a specific external website while blocking all other outbound traffic. What should they configure?

Accepted Answer

Add an Application Rule with the destination FQDN of the website.. Option A is correct because Application Rules filter outbound traffic based on FQDN (e.g., *.contoso.com). Option B is wrong because Network Rules filter based on IP addresses/ports, not FQDNs. Option C is wrong because DNAT rules are for inbound traffic. Option D is wrong because Threat Intelligence rules block known malicious IPs/FQDNs, not allow specific ones.

Answer

Add a Network Rule with the destination IP address and port 443.

Answer

Add a Threat Intelligence rule to allow the website's domain.

Answer

Add a DNAT Rule to translate the traffic to the website's IP.

Question 12

You are designing a secure hybrid network for a multinational company. They require encrypted communication between on-premises data centers and Azure, with high availability and no single point of failure. Which solution should you recommend?

Accepted Answer

Deploy ExpressRoute with a site-to-site VPN as a failover.. Option B is correct because ExpressRoute with a VPN gateway failover provides a private dedicated connection with encrypted site-to-site VPN as backup, meeting high availability and encryption. Option A is wrong because site-to-site VPN alone lacks the private dedicated connection. Option C is wrong because Azure Virtual WAN is a networking service, not a specific connectivity solution, and point-to-site VPN is for remote users. Option D is wrong because ExpressRoute does not encrypt traffic by default; encryption must be added separately.

Answer

Deploy a site-to-site VPN over the internet with two active VPN devices.

Answer

Deploy Azure Virtual WAN with point-to-site VPN for each data center.

Answer

Deploy ExpressRoute without encryption and rely on Microsoft backbone security.

Question 13

Refer to the exhibit. You run the PowerShell script to check compliance of the 'RequireSQLEncryption' policy assignment. The script returns no output. What is the most likely reason?

Accepted Answer

The Get-AzPolicyState cmdlet is not a valid Azure PowerShell cmdlet; it should be Get-AzPolicyStateSummary.. Option A is correct because Get-AzPolicyState requires the PolicyState parameter to be specified, or the result will be empty if no non-compliant resources exist. However, the script uses the Scope property from the policy assignment, which may not be correct. But more importantly, the cmdlet Get-AzPolicyState is not a standard Azure PowerShell cmdlet; the correct cmdlet is Get-AzPolicyStateSummary or Get-AzPolicyState with the -PolicyAssignmentName parameter. Since the cmdlet name is wrong, it will fail or return nothing. Option B is wrong because the script does not check if resources exist. Option C is wrong because compliance state is not 'Compliant' but the cmdlet is wrong. Option D is wrong because resource group scope is valid.

Answer

The policy assignment is scoped to a management group, not a resource group.

Answer

All resources are compliant, so the Where-Object filter returns empty.

Answer

There are no resources in the resource group InfrastructureRG.

Question 14

Your company uses Microsoft Entra ID for identity management. You need to implement a solution to automatically detect and remediate risky sign-ins using machine learning. What should you configure?

Accepted Answer

Configure Microsoft Entra ID Protection and enable risk-based policies.. Option C is correct because Identity Protection uses ML to detect risks and can automatically remediate (e.g., require MFA, block sign-in). Option A is wrong because Conditional Access policies enforce access controls but do not detect risks. Option B is wrong because Privileged Identity Management (PIM) manages privileged roles. Option D is wrong because Azure AD (Entra ID) Connect syncs identities, not risk detection.

Answer

Configure Microsoft Entra Connect to sync on-premises identities.

Answer

Configure Conditional Access policies with session controls.

Answer

Configure Privileged Identity Management (PIM) for admin roles.

Question 15

You are designing a security solution for Azure Kubernetes Service (AKS). You need to ensure that only authorized container images from a private container registry can run in the cluster. What should you configure?

Accepted Answer

Use Azure Policy to enforce that containers run only from allowed registries.. Option B is correct because Azure Policy for Kubernetes can enforce using only images from specific registries via built-in policy 'Ensure only allowed container images'. Option A is wrong because AKS network policies control traffic, not image source. Option C is wrong because Azure Container Registry tasks build images, not enforce usage. Option D is wrong because Microsoft Defender for Containers provides threat detection, not image authorization.

Answer

Implement Azure Container Registry tasks to scan images.

Answer

Configure network policies in AKS to block outbound traffic to public registries.

Answer

Enable Microsoft Defender for Containers to block unauthorized images.