SC-100 Design security solutions for infrastructure Practice Test 4 — 15 Questions

Question 1

Your company uses Microsoft Defender for Endpoint and Microsoft Intune to manage endpoints. You need to ensure that devices are healthy before they can access corporate resources. Which TWO settings should you configure in Microsoft Intune compliance policies to enforce device health?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Require device encryption (BitLocker) on Windows devices. Requiring antivirus (Windows Defender) to be active ensures protection against malware. Requiring encryption (BitLocker) protects data at rest on lost devices. Password length and OS version are important but not the most direct health checks for threat protection. Jailbreak detection is for mobile devices.

Answer

Require a minimum password length of 8 characters

Answer

Require that the device is not jailbroken or rooted

Answer

Require the device to be on a specific OS version

Question 2

Refer to the exhibit. You are reviewing a PowerShell script that configures network security. What is the effect of the NSG rule created in this script?

Accepted Answer

It blocks all inbound traffic from the internet to the subnet.. The rule denies all inbound traffic from the 'Internet' service tag to all ports and protocols. 'Internet' includes traffic from outside Azure. The rule is applied at the subnet level. It does not affect outbound traffic, nor traffic from other Azure services unless they originate from the internet.

Answer

It blocks all outbound traffic to the internet from the subnet.

Answer

It blocks inbound traffic only from specific IP ranges.

Answer

It allows inbound traffic from the internet, then denies it.

Question 3

Refer to the exhibit. You are reviewing an ARM template for an Azure App Service configuration. What is the effect of the ipSecurityRestrictions array?

Accepted Answer

It allows traffic from 192.168.0.0/24 and denies all other traffic.. The rules are evaluated in priority order. The first rule allows traffic from 192.168.0.0/24. The second rule denies all other traffic (Any). This effectively restricts access to only the specified corporate IP range. The order matters because if the deny rule had lower priority, it would block the allowed range.

Answer

It allows all traffic because the deny rule has a higher priority number.

Answer

It denies traffic from 192.168.0.0/24 and allows all other traffic.

Answer

It denies all traffic because the deny rule covers any IP.

Question 4

Your organization has deployed Microsoft Defender for Cloud with the CSPM (Cloud Security Posture Management) plan enabled. You need to ensure that all Azure subscriptions are covered and that security recommendations are automatically remediated for critical findings. Which two actions should you take? (Choose two.)

Accepted Answer

Enable Microsoft Defender for Cloud on all subscriptions.. Enabling Microsoft Defender for Cloud on all subscriptions (A) ensures that every subscription is monitored and assessed for security posture. Configuring automatic provisioning of the Log Analytics agent (C) allows Defender for Cloud to collect necessary data from Azure resources, which enables it to evaluate security configurations and automatically apply remediation for certain critical findings (e.g., via built-in auto-remediation settings). Option B configures notifications but does not affect remediation or coverage. Option D is incorrect because the 'Auto Remediate' toggle is per-recommendation and not a global setting for all recommendations. Option E is a valid method for custom remediation using Azure Policy, but it is not required; Defender for Cloud's built-in capabilities suffice for automatic remediation of many critical findings. Therefore, the two required actions are A and C.

Answer

Configure security contact details for each subscription.

Answer

Set the 'Auto Remediate' toggle to 'On' for all security recommendations.

Answer

Create Azure Policy assignments with 'deployIfNotExists' effect to auto-remediate critical findings.

Question 5

Your organization plans to use Microsoft Defender for Cloud to protect a hybrid environment with servers in Azure and on-premises. You need to ensure that security policies are consistently applied across all servers. What should you configure?

Accepted Answer

Onboard all servers to Azure Arc and assign Defender for Cloud policies.. Onboarding servers to Azure Arc allows non-Azure servers to be managed with the same Azure Policy and Defender for Cloud policies as Azure VMs, ensuring consistent security policy enforcement across hybrid environments. Option B (Azure Automation State Configuration) is for configuration management, not policy enforcement. Option C (Microsoft Sentinel) is a SIEM, not a policy enforcement tool. Option D (Azure Policy with guest configuration) requires Azure Arc for non-Azure machines, making it less direct than option A, which directly addresses the requirement.

Answer

Deploy Azure Automation State Configuration (DSC) to all servers.

Answer

Connect all servers to Microsoft Sentinel and use analytics rules.

Answer

Use Azure Policy with guest configuration on all servers.

Question 6

Refer to the exhibit. You are designing a security solution for Azure SQL Database. The exhibit shows an Azure Policy definition. When this policy is assigned, which problem might occur?

Accepted Answer

The remediation deployment will fail because the storage account key is missing.. The DeployIfNotExists policy definition attempts to deploy Azure SQL Database audit settings by writing audit logs to a storage account. The template likely specifies a storage endpoint but does not include a storage account access key or configure a managed identity, causing the remediation deployment to fail without proper authentication. Option A is incorrect because 'default' is the valid resource name for audit settings child resource. Option C is incorrect because the field name in existenceCondition is spelled correctly as 'Enabled'. Option D is incorrect because the policy uses DeployIfNotExists effect, which includes automatic remediation, not just audit.

Answer

The policy will fail because the audit settings resource name 'default' is invalid.

Answer

The existenceCondition will never evaluate to true because the field name is misspelled.

Answer

The policy will only audit non-compliant servers without remediation.

Question 7

A company uses Azure Firewall to protect their virtual network. They need to allow outbound HTTPS traffic to a specific external website while blocking all other outbound traffic. What should they configure?

Accepted Answer

Add an Application Rule with the destination FQDN of the website.. Application Rules filter outbound traffic based on FQDN (e.g., *.contoso.com). Option B is wrong because Network Rules filter based on IP addresses/ports, not FQDNs. Option C is wrong because Threat Intelligence rules block known malicious IPs/FQDNs, not allow specific ones. Option D is wrong because DNAT rules are for inbound traffic.

Answer

Add a Network Rule with the destination IP address and port 443.

Answer

Add a Threat Intelligence rule to allow the website's domain.

Answer

Add a DNAT Rule to translate the traffic to the website's IP.

Question 8

You are designing a secure hybrid network for a multinational company. They require encrypted communication between on-premises data centers and Azure, with high availability and no single point of failure. Which solution should you recommend?

Accepted Answer

Deploy ExpressRoute with a site-to-site VPN as a failover.. It provides a dedicated private connection via ExpressRoute (low latency, reliable) with an encrypted site-to-site VPN as backup, ensuring both encryption and high availability with no single point of failure. Option B is wrong because site-to-site VPN over the internet lacks the dedicated private connection, introducing potential latency and reliability issues. Option C is wrong because point-to-site VPN is for individual remote clients, not for site-to-site connectivity between data centers. Option D is wrong because ExpressRoute alone does not encrypt traffic, violating the encryption requirement.

Answer

Deploy a site-to-site VPN over the internet with two active VPN devices.

Answer

Deploy Azure Virtual WAN with point-to-site VPN for each data center.

Answer

Deploy ExpressRoute without encryption and rely on Microsoft backbone security.

Question 9

Refer to the exhibit. You run the PowerShell script to check compliance of the 'RequireSQLEncryption' policy assignment. The script returns no output. What is the most likely reason?

Accepted Answer

All resources are compliant, so the Where-Object filter returns empty.. The script uses Get-AzPolicyState to retrieve policy states and then filters for non-compliant resources with Where-Object. If there are no non-compliant resources, the Where-Object filter returns empty, resulting in no output. Option C correctly identifies this as the most likely reason, as it is a common scenario when policies are compliant. Option A is incorrect because Get-AzPolicyState is a valid Azure PowerShell cmdlet. Option B is incorrect because the script does not depend on management group scope for output. Option D is less likely because even without resources, the cmdlet would still execute, but the filter would still be empty.

Answer

The Get-AzPolicyState cmdlet is not a valid Azure PowerShell cmdlet; it should be Get-AzPolicyStateSummary.

Answer

The policy assignment is scoped to a management group, not a resource group.

Answer

There are no resources in the resource group InfrastructureRG.

Question 10

Your company uses Microsoft Entra ID for identity management. You need to implement a solution to automatically detect and remediate risky sign-ins using machine learning. What should you configure?

Accepted Answer

Configure Microsoft Entra ID Protection and enable risk-based policies.. Microsoft Entra ID Protection uses machine learning to detect risky sign-ins and can automatically remediate them (e.g., require MFA, block sign-in). Option A is wrong because Microsoft Entra Connect syncs on-premises identities to Entra ID but does not detect risks. Option B is wrong because Conditional Access policies enforce access controls based on conditions but do not detect risks on their own. Option D is wrong because Privileged Identity Management (PIM) manages privileged role assignments and access, not risk detection.

Answer

Configure Microsoft Entra Connect to sync on-premises identities.

Answer

Configure Conditional Access policies with session controls.

Answer

Configure Privileged Identity Management (PIM) for admin roles.

Question 11

You are designing a security solution for Azure Kubernetes Service (AKS). You need to ensure that only authorized container images from a private container registry can run in the cluster. What should you configure?

Accepted Answer

Use Azure Policy to enforce that containers run only from allowed registries.. Azure Policy with the built-in policy 'Ensure only allowed container images' can enforce that containers in AKS run only from specified registries, such as a private Azure Container Registry (ACR). Option B is incorrect because Azure Container Registry Tasks scan and build images but do not enforce image source authorization. Option C is incorrect because network policies control network traffic, not image source. Option D is incorrect because Microsoft Defender for Containers provides threat detection and security monitoring, not image authorization.

Answer

Implement Azure Container Registry tasks to scan images.

Answer

Configure network policies in AKS to block outbound traffic to public registries.

Answer

Enable Microsoft Defender for Containers to block unauthorized images.

Question 12

Refer to the exhibit. You run the PowerShell script to apply an NSG to a subnet. However, connectivity tests show that the NSG rule is not being applied. What is the most likely reason?

Accepted Answer

The script is missing the Set-AzVirtualNetwork call after updating the subnet.. After using Set-AzVirtualNetworkSubnetConfig to modify the subnet configuration (including NSG association), you must call Set-AzVirtualNetwork to apply the changes to the virtual network. Without this step, the NSG association is not saved. Option A is incorrect because Set-AzVirtualNetworkSubnetConfig does associate the NSG, but the change is not persisted. Option C is incorrect because rule priority 100 is higher (lower number) than any existing lower priority rules, so no conflict occurs. Option D is incorrect because NSGs can be associated to subnets, and the script correctly targets the subnet; the issue is the missing update.

Answer

The NSG was not associated to the subnet; Set-AzVirtualNetworkSubnetConfig does not associate the NSG.

Answer

The rule priority 100 conflicts with an existing rule with lower priority.

Answer

The NSG should be associated to the network interface instead of the subnet.

Question 13

You need to secure Azure Blob Storage by encrypting data at rest using customer-managed keys stored in Azure Key Vault. What should you configure?

Accepted Answer

Configure encryption with customer-managed keys in Azure Key Vault and enable infrastructure encryption.. Azure Storage encryption with customer-managed keys uses Key Vault and requires enabling 'Infrastructure encryption' for double encryption. Option A is wrong because Azure Purview is for data governance, not encryption. Option B is wrong because Azure Disk Encryption is for VM disks. Option D is wrong because Azure Information Protection is for classification, not storage encryption.

Answer

Enable Azure Purview to manage encryption keys.

Answer

Enable Azure Disk Encryption for the storage account.

Answer

Enable Azure Information Protection for the storage account.

Question 14

Which TWO actions should you take to protect Azure Virtual Machines from ransomware? (Choose two.)

Accepted Answer

Enable Azure Backup with immutable vault.. The correct answers are C and E. Option C: Azure Backup with immutable vault provides backup copies that cannot be altered or deleted, protecting against ransomware encrypting or deleting data. Option E: Microsoft Defender for Servers (part of Defender for Cloud) offers threat detection, alerts, and security recommendations that can identify and respond to ransomware activities. Option A is incorrect because Azure Firewall blocks traffic but does not provide backup or detection. Option B is incorrect because Azure Site Recovery is for disaster recovery (failover), not backup. Option D is incorrect because Azure Policy enforces compliance rules (e.g., encryption at rest) but does not directly protect against ransomware.

Answer

Deploy Azure Firewall to block all inbound traffic.

Answer

Configure Azure Site Recovery for all VMs.

Answer

Assign Azure Policy to require encryption at rest.

Question 15

Which THREE components are required to implement a secure Azure DevOps CI/CD pipeline that scans for secrets in code? (Choose three.)

Accepted Answer

GitHub Advanced Security for secret scanning.. GitHub Advanced Security includes secret scanning for code repositories. Option C is correct because Credential Scanner is a Microsoft security tool integrated into Azure DevOps for scanning secrets. Option E is correct because Azure Key Vault can store secrets used in pipelines, and it is required to securely store secrets. Option A is wrong because Azure Artifacts is a package management solution, not for scanning secrets. Option D is wrong because Azure Boards is for work item tracking, not for scanning secrets.

Answer

Azure Artifacts to store packages.

Answer

Azure Boards for tracking security issues.