SC-100 Design security solutions for infrastructure Practice Test 4 — 15 Questions

Question 1

You are designing a privileged access solution for your Azure infrastructure. You need to ensure that just-in-time (JIT) access is required for all administrative actions on Azure VMs. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Just-in-time VM access in Microsoft Defender for Cloud. Microsoft Defender for Cloud's JIT VM access provides time-bound access to VMs. Option A is incorrect because PIM is for role-based access, not VM access. Option C is incorrect because network security groups with service tags can filter traffic but do not enforce just-in-time access. Option D is incorrect because Azure Bastion with Conditional Access provides secure RDP/SSH with conditional access policies, but does not enforce just-in-time access.

Answer

Microsoft Entra Privileged Identity Management (PIM) for Azure VM roles

Answer

Network security groups with service tags

Answer

Azure Bastion with Conditional Access

Question 2

Your organization uses Microsoft Purview to classify sensitive data in Azure storage. You need to ensure that a file containing PII is automatically protected when uploaded to an Azure Blob Storage account. What should you use?

Accepted Answer

Microsoft Purview Information Protection auto-labeling policy. Microsoft Purview Information Protection auto-labeling policies automatically apply sensitivity labels based on classification results. When a file containing PII is uploaded to Azure Blob Storage, an auto-labeling policy can apply a sensitivity label that enforces protection (e.g., encryption). Option C is the correct feature for automatic labeling.

Answer

Microsoft Purview retention labels

Answer

Microsoft Purview Information Protection sensitivity labels manually applied

Answer

Azure Information Protection unified labeling client

Question 3

Refer to the exhibit. You are reviewing an Azure Policy definition in JSON. What does this policy do?

Accepted Answer

Denies SQL servers from using Azure AD authentication. The correct option is A: the policy denies SQL servers from using Microsoft Entra ID authentication. In Azure Policy, a deny-effect policy with a condition matching the Microsoft Entra ID authentication setting (such as the 'administrators' or 'azureADOnlyAuthentication' property) blocks the deployment or update of SQL servers configured that way. Option B is wrong because the policy's effect is deny, not allow or audit. Option C is wrong because the condition targets Microsoft Entra ID authentication, not firewall rules. Option D is wrong because enforcing an Microsoft Entra ID admin would require a DeployIfNotExists or audit/modify policy, not a deny of Microsoft Entra ID authentication.

Answer

Allows SQL servers to use Azure AD authentication

Answer

Denies SQL servers that do not have a firewall rule

Answer

Enforces that all SQL servers must have an Azure AD admin

Question 4

Refer to the exhibit. You run the PowerShell cmdlet and see that EnabledForDiskEncryption is false. You need to ensure that this key vault can be used for Azure Disk Encryption. What should you do?

Accepted Answer

Run Set-AzKeyVaultAccessPolicy with the -EnabledForDiskEncryption parameter. Run Set-AzKeyVaultAccessPolicy with the -EnabledForDiskEncryption parameter. This cmdlet updates the key vault's access policy so that the Microsoft.Compute resource provider is authorized to retrieve secrets and keys from the vault, which is required for Azure Disk Encryption to function. The -EnabledForDiskEncryption flag specifically enables the vault for disk encryption scenarios, and it can be applied to an existing vault without recreating it. Option A is unnecessary because the vault does not need to be re-created; the setting can be enabled post-deployment. Options C and D are incorrect because -EnabledForDeployment is for Azure Resource Manager VM deployment from the vault, and -EnabledForTemplateDeployment is for ARM template deployments, neither of which satisfies the disk encryption requirement.

Answer

Re-create the key vault with -EnabledForDiskEncryption parameter

Answer

Run Set-AzKeyVaultAccessPolicy with the -EnabledForDeployment parameter

Answer

Run Set-AzKeyVaultAccessPolicy with the -EnabledForTemplateDeployment parameter

Question 5

Refer to the exhibit. You are reviewing a KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

Count security events per user, per computer, per event type in the last hour. The correct option is D: the query counts security events per user, per computer, and per event type over the last hour. This matches a typical Microsoft Sentinel KQL aggregation pattern using SecurityEvent, a time filter such as where TimeGenerated > ago(1h), and a summarize operator with count() grouped by Account, Computer, and EventID. Options A and B are too narrow because they describe filtering for specific logon outcomes rather than aggregating counts across dimensions. Option C is also incorrect because it only mentions event IDs and omits the per-user and per-computer grouping that defines the query's purpose.

Answer

List all administrator accounts that logged in

Answer

Identify failed logon attempts across all computers

Answer

Find the most common event IDs across all computers

Question 6

Which TWO of the following are requirements for implementing Azure Disk Encryption on Windows VMs? (Choose two.)

Accepted Answer

The BitLocker Drive Encryption feature must be available (Windows). Azure Disk Encryption for Windows VMs requires the BitLocker Drive Encryption feature to be available on the VM (option A) and that the VM is a supported size (option B). While an Azure Key Vault is used for encryption keys, the EnabledForDiskEncryption property is automatically enabled when you enable disk encryption, so it is not a prerequisite that needs to be set beforehand. A public IP address and an Azure Backup vault are not required.

Answer

The VM must have a public IP address

Answer

An Azure Key Vault with the EnabledForDiskEncryption property set to true

Answer

An Azure Backup vault in the same region

Question 7

Your organization is designing a hybrid identity infrastructure with Microsoft Entra ID. You need to ensure that users can access on-premises applications using passwordless authentication and that the solution minimizes latency for authentication requests. What should you implement?

Accepted Answer

Use Microsoft Entra application proxy to publish the on-premises applications and enable passwordless authentication.. Microsoft Entra application proxy is the correct choice because it publishes on-premises web applications through Microsoft Entra ID, enabling passwordless authentication (e.g., FIDO2 keys, Windows Hello) without requiring domain-joined devices or VPN. It also minimizes latency by using a lightweight connector on-premises that establishes outbound connections to the Entra proxy service, avoiding the need for inbound firewall rules or complex network routing. This solution directly addresses both requirements: passwordless access and low-latency authentication.

Answer

Join the on-premises servers to Microsoft Entra Domain Services and use passwordless authentication.

Answer

Install Web Application Proxy (WAP) on-premises and integrate with Microsoft Entra ID for passwordless.

Answer

Deploy a VPN and use Microsoft Entra ID with passwordless sign-in.

Question 8

Refer to the exhibit. You are reviewing an Azure Policy definition that denies deployment of virtual machines without encryption at host enabled. A developer reports they cannot deploy a VM that already has encryption at host enabled. What is the most likely cause?

Accepted Answer

The policy definition uses an incorrect field path for encryptionAtHost.. The correct answer is C: the policy definition uses an incorrect field path for encryptionAtHost. In Azure Policy, a deny effect evaluates the specified field against the condition, so if the alias or path for encryptionAtHost is wrong, the policy cannot correctly read the VM's encryption setting and may deny a compliant VM. The correct alias is typically Microsoft.Compute/virtualMachines/encryptionAtHost (or the relevant securityProfile property), and a typo or wrong path causes the condition to evaluate as false or missing. Option A is wrong because a properly scoped policy can target only VMs without encryption, not all VMs. Option B is wrong because an audit effect would not block deployment at all. Option D is wrong because an exemption is not required for a VM that already meets the policy condition.

Answer

The policy applies to all VMs regardless of encryption setting.

Answer

The policy effect is 'audit' instead of 'deny', so it does not block deployment.

Answer

The policy is missing an exemption for the developer's subscription.

Question 9

Your company is designing a secure baseline for Azure Linux virtual machines using Azure Policy. You need to ensure that all Linux VMs have SSH access restricted, disk encryption enabled, and vulnerability assessments installed. Which THREE built-in policies should you assign? (Choose THREE.)

Accepted Answer

[Preview]: Configure Linux VMs to install the Azure Security Agent for vulnerability assessment. Option B is correct because the '[Preview]: Configure Linux VMs to install the Azure Security Agent for vulnerability assessment' policy deploys the Azure Security Agent (the extension that powers Microsoft Defender for Cloud's vulnerability assessment on Linux VMs), directly satisfying the requirement that vulnerability assessments be installed. Option D is correct because 'Disk encryption should be applied on virtual machines' audits VMs to ensure their OS and data disks are encrypted (Azure Disk Encryption/BitLocker and DM-Crypt), which fulfills the disk encryption requirement. Option E is correct because '[Preview]: Linux machines should meet requirements for the Azure compute security baseline' audits Linux VMs against the Azure compute security baseline, which includes SSH access restrictions such as disabling password authentication and restricting remote connections, satisfying the SSH restriction requirement. Option A is not correct because Microsoft Antimalware is a Windows-only extension and does not apply to Linux VMs. Option C is not correct because Windows Defender Credential Guard is a Windows-specific security feature and is irrelevant to Linux VMs.

Answer

Microsoft Antimalware for Azure must be configured with automatic update

Answer

Windows Defender Credential Guard should be enabled on Windows VMs

Question 10

Your company uses Microsoft Purview to govern data across Azure and on-premises. You need to classify sensitive data such as credit card numbers in Azure SQL Database and apply automatic retention labels. What should you configure?

Accepted Answer

Create a scan in Microsoft Purview Data Map and apply retention labels based on classifications.. Option A is correct because Microsoft Purview Data Map scans register and scan Azure SQL Database sources, and the classification results (such as credit card numbers detected by built-in sensitive information types) can be used to auto-apply retention labels via auto-labeling policies in Microsoft Purview. This directly addresses both requirements: classifying sensitive data in Azure SQL Database and applying automatic retention labels. Option B is wrong because Defender for Cloud Apps is a CASB for discovering and governing cloud app usage, not the service that scans Azure SQL Database for classification and retention labeling. Option C is wrong because sensitivity labels in Information Protection handle confidentiality/encryption markings, not retention labels or data map scanning of Azure SQL. Option D is wrong because Microsoft Sentinel is a SIEM/SOAR platform for threat detection, not a data classification or retention labeling mechanism.

Answer

Enable Microsoft Defender for Cloud Apps to classify and label data in Azure SQL.

Answer

Configure sensitivity labels in Microsoft Purview Information Protection.

Answer

Use Microsoft Sentinel to detect credit card numbers and trigger a retention policy.

Question 11

Your organization uses Microsoft Defender for Cloud to secure a hybrid environment. You need to ensure that security recommendations are automatically remediated for virtual machines. The solution must use Azure Policy and must be deployed at scale. What should you configure?

Accepted Answer

Create a remediation task for the policy that needs auto-remediation. The correct option is B: Create a remediation task for the policy that needs auto-remediation. In Microsoft Defender for Cloud, automatic remediation of security recommendations for VMs at scale is achieved by using Azure Policy's remediation tasks, which apply the deployIfNotExists (or modify) effect to bring non-compliant resources into compliance without manual intervention. A remediation task is the specific mechanism that triggers the policy's remediation effect across the assigned scope, enabling automated fixes for recommendations. Option A is incorrect because a custom policy definition with deployIfNotExists only defines the remediation logic but does not itself perform remediation; a remediation task must still be created. Option C is incorrect because assigning a built-in policy initiative only evaluates compliance and does not automatically remediate resources. Option D is incorrect because auto-provisioning the Log Analytics agent installs monitoring, not automated remediation of security recommendations.

Answer

Create a custom Azure Policy definition with deployIfNotExists effect

Answer

Assign a built-in policy initiative to the management group

Answer

Enable auto-provisioning for the Log Analytics agent

Question 12

Your company is implementing a zero-trust network architecture in Azure. You need to ensure that all network traffic between virtual machines is encrypted and authenticated, regardless of the virtual network they reside in. What should you implement?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway provides encrypted site-to-site VPN connections between virtual networks, ensuring that all traffic between VMs in different VNets is encrypted and authenticated. This aligns with zero-trust principles by providing encryption regardless of network boundaries. Option B is incorrect because Azure Virtual Network encryption only encrypts traffic within the same VNet, not across VNets. Option C is incorrect because NSGs filter traffic but do not encrypt. Option D is incorrect because Azure Firewall filters and logs traffic but does not encrypt.

Answer

Azure Virtual Network encryption

Answer

Network Security Groups (NSGs)

Answer

Azure Firewall

Question 13

You are designing a security solution for Azure resources using Azure Policy. You need to ensure that all storage accounts enforce HTTPS traffic and that only certain virtual networks can access them. Which THREE policy effects can you use to achieve this?

Accepted Answer

DeployIfNotExists. D, and E are correct. Deny prevents creation of non-compliant resources, Audit logs non-compliant resources, and DeployIfNotExists can deploy network rules. Option B is wrong because Append adds to existing resources but not for network rules. Option C is wrong because Modify changes properties, but not suitable for enforcing HTTPS.

Answer

Append

Answer

Modify

Question 14

Refer to the exhibit. You are deploying an ARM template that creates a network security group (NSG) named nsg-backend. What is the effect of this NSG on inbound traffic?

Accepted Answer

Only inbound traffic from 10.0.1.0/24 on port 80 is allowed; all other inbound traffic is denied. Option C is correct because an NSG with a custom inbound rule that allows traffic only from 10.0.1.0/24 on port 80, combined with the NSG's default rules, results in that traffic being permitted while all other inbound traffic is denied by the default DenyAllInBound rule. Azure NSGs always include default rules, including AllowVnetInBound, AllowAzureLoadBalancerInBound, and DenyAllInBound, so the absence of an explicit deny rule does not mean traffic is allowed. Option A is wrong because the NSG does not deny only port 80; it denies all inbound traffic not explicitly allowed. Option B is wrong because the default DenyAllInBound rule is always present. Option D is wrong because traffic from 10.0.1.0/24 on port 80 is allowed, not excluded from an allow-all policy.

Answer

Only inbound traffic on port 80 is denied

Answer

All inbound traffic is allowed because no default deny rule is present

Answer

All inbound traffic is allowed except from 10.0.1.0/24

Question 15

Your organization plans to deploy Microsoft Defender for Cloud to protect hybrid workloads. You need to design the agentless scanning deployment for Azure VMs running SQL Server. What should you configure?

Accepted Answer

In Microsoft Defender for Cloud, enable the 'defenderForSql' plan and set the 'agentlessScanning' property to 'true'.. The correct option is A: enabling the 'defenderForSql' plan in Microsoft Defender for Cloud and setting the 'agentlessScanning' property to 'true'. This is the documented configuration for agentless SQL Server scanning on Azure VMs, as it activates the Defender for SQL plan and turns on the agentless scanning capability that uses disk snapshots rather than an in-guest agent. Option B is incorrect because the Log Analytics agent (MMA) is used for data collection and is not the mechanism for agentless scanning. Option C is incorrect because SQL Vulnerability Assessment is a feature that can be enabled within the plan but does not itself configure agentless scanning. Option D is incorrect because an Azure Policy initiative assigns or audits the plan but does not set the 'agentlessScanning' property required for agentless scanning.

Answer

Deploy the Log Analytics agent on each SQL Server VM.

Answer

Enable SQL Vulnerability Assessment in Microsoft Defender for Cloud.

Answer

Configure Azure Policy to assign the 'Enable Defender for Cloud for SQL Servers' initiative.