SC-100 Design security solutions for infrastructure Practice Test 5 — 15 Questions

Question 1

You are designing a backup strategy for a Microsoft 365 tenant. You need to ensure that Exchange Online mailbox items deleted by users can be recovered up to 30 days after deletion, without using third-party tools. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable single item recovery for the mailbox.. Single item recovery (option C) is correct because it preserves deleted items in the Recoverable Items folder so users or admins can restore them after the Deleted Items folder is emptied, and by default Exchange Online retains these items for 14 days, extendable to 30 days via the mailbox's retained items period. This meets the requirement without third-party tools. Litigation hold (A) preserves items indefinitely for legal purposes but is not the intended mechanism for a general 30-day recovery window, and it requires specific hold settings. A Microsoft 365 retention policy (B) is designed for compliance retention or deletion of content, not for restoring user-deleted mailbox items. Azure Backup (D) does not back up Exchange Online mailboxes in Microsoft 365; it is for Azure workloads.

Answer

Place the mailbox on litigation hold.

Answer

Create a Microsoft 365 retention policy for Exchange mailboxes.

Answer

Configure Azure Backup for Microsoft 365.

Question 2

Your organization is migrating on-premises Active Directory to Microsoft Entra ID. You need to design the authentication method to support hybrid identities with seamless single sign-on (SSO) for legacy applications that require Kerberos authentication. What should you implement?

Accepted Answer

Enable Microsoft Entra Seamless SSO via Microsoft Entra Connect.. Microsoft Entra Connect with Seamless SSO enables Kerberos-based authentication for hybrid users. Option A is wrong because federation with ADFS is not required for Kerberos. Option B is wrong because PHS does not support Kerberos delegation. Option C is wrong because PTA does not support Kerberos.

Answer

Federate Microsoft Entra ID with on-premises Active Directory using ADFS.

Answer

Use password hash synchronization (PHS) only.

Answer

Deploy pass-through authentication (PTA).

Question 3

Refer to the exhibit. You are reviewing an Azure Policy definition. What will this policy do when assigned to a subscription?

Accepted Answer

Prevent creation of virtual machines with OS disks that are not Premium SSD.. Option D is correct because the policy definition targets the OS disk configuration of virtual machines and denies (or blocks) deployment when the OS disk SKU is not Premium SSD, effectively preventing creation of VMs with non-Premium SSD OS disks. This matches the typical Azure Policy pattern of using a deny effect on the Microsoft.Compute/disks or VM storageProfile.osDisk SKU field with a condition such as 'not equals Premium_LRS'. Option A is too broad because the policy only affects OS disk SKU, not all VM creation. Option B is incorrect because the policy enforces/denies rather than merely auditing existing resources. Option C is incorrect because the policy concerns OS disks, not data disks.

Answer

Deny creation of all virtual machines.

Answer

Audit existing virtual machines for compliance.

Answer

Enforce Premium SSD on data disks.

Question 4

Refer to the exhibit. You are reviewing a Microsoft Sentinel analytics rule in your workspace. The output shows the rule 'MFA Disabled' is enabled with severity Medium. The query returns events where MFA is absent. What is the primary issue with this rule?

Accepted Answer

The query does not include a time range, which will cause excessive alerts.. The query does not include a time range, which will cause excessive alerts. In Microsoft Sentinel analytics rules, the query itself must constrain the search window (for example with a `where TimeGenerated > ago(1h)` clause) because the rule's scheduling settings alone do not limit what the KQL query scans; without it, the query evaluates all retained data and generates far more results than intended. Options A and B are incorrect because disabling the rule or raising severity does not address the underlying query design flaw, and option C is wrong because the trigger threshold is not the root cause of the excessive alert volume here.

Answer

The rule should be disabled until tuned.

Answer

The severity should be High.

Answer

The trigger threshold is too low.

Question 5

Which TWO actions should you take to protect Azure Virtual Machines from ransomware attacks? (Choose two.)

Accepted Answer

Enable Azure Backup for all VMs.. Option B is correct because enabling Azure Backup for all VMs provides recovery points (via Recovery Services vaults with soft delete and immutable backups) that let you restore encrypted or corrupted data after a ransomware attack, which is the primary defense against extortion. Option E is correct because Microsoft Defender Antivirus with real-time protection detects and blocks ransomware payloads and malicious processes on the VM before they can encrypt files, providing proactive endpoint protection. Option A is not appropriate because blocking all outbound traffic with Azure Firewall would break legitimate VM operations, updates, and management traffic, and is not a targeted ransomware control. Option C is not correct because auto-shutdown schedules only reduce cost and attack surface during idle hours; they do not prevent or mitigate ransomware. Option D is not correct because although disabling RDP from the internet reduces brute-force entry points, it is a hardening measure against initial access rather than a direct ransomware protection control, and the question asks for the two best actions.

Answer

Configure Azure Firewall to block all outbound traffic.

Answer

Use auto-shutdown schedules for VMs.

Answer

Disable RDP access from the internet.

Question 6

Your organization has a multi-region Azure deployment with ExpressRoute connections to on-premises. You need to design a solution that ensures all traffic between on-premises and Azure is inspected by a firewall for both inbound and outbound connections. The solution must minimize latency and avoid a single point of failure. What design should you recommend?

Accepted Answer

Deploy Azure Firewall in each region with forced tunneling enabled. Deploying Azure Firewall in each region with forced tunneling ensures all traffic between on-premises and Azure is inspected by a firewall, minimizes latency because traffic is inspected locally, and avoids a single point of failure by using multiple firewalls. Option B is incorrect because a single central hub creates a single point of failure and adds latency. Option C is incorrect because NSGs filter traffic based on rules but do not provide stateful inspection. Option D is incorrect because a third-party NVA in a single hub introduces a single point of failure and higher latency.

Answer

Deploy Azure Firewall in one central hub region and route all traffic through it

Answer

Use Network Security Groups (NSGs) on subnets to filter traffic

Answer

Deploy a third-party NVA in a hub-and-spoke topology with a single hub

Question 7

Refer to the exhibit. The NSG is applied to a subnet containing a web server. The web server is not receiving HTTP traffic. What is the most likely cause?

Accepted Answer

The sourceAddressPrefix 'Internet' does not include all source IPs. The 'Internet' service tag in Azure NSG rules only includes public IP address ranges. If the HTTP traffic originates from a private IP address—such as from an on-premises network connected via VPN or ExpressRoute, or from a peered VNet—it will not match the 'Internet' tag and will be dropped by the default deny rule. Therefore, the most likely cause is that the source address prefix does not cover the actual source IPs of the incoming traffic.

Answer

The DenyAllOther rule has a lower priority than AllowHTTP

Answer

The rule direction is Inbound, but the traffic is outbound

Answer

The priority of the AllowHTTP rule is too low (100)

Question 8

A company is implementing a zero-trust network for their Azure environment. They want to ensure that only authenticated and authorized users can access specific VMs, regardless of network location. Which Azure service should they use?

Accepted Answer

Azure Bastion. Azure Bastion (option B) is correct because it provides secure RDP/SSH access to VMs directly through the Azure portal over TLS, without exposing public IP addresses or requiring a VPN, and it enforces authentication and authorization for each connection regardless of the user's network location, which aligns with zero-trust principles. Just-in-Time VM Access (option A) only temporarily opens NSG rules for management ports and still requires an existing connectivity path, so it does not by itself provide the authenticated, location-independent access described. A Site-to-Site VPN (option C) extends network-level connectivity between on-premises and Azure but does not enforce per-user authentication and authorization to specific VMs. Network Security Groups (option D) are stateful packet filters that allow or deny traffic by IP, port, and protocol, but they do not authenticate users or authorize individual access to VMs.

Answer

Just-in-Time (JIT) VM Access

Answer

Site-to-Site VPN

Answer

Network Security Groups (NSGs)

Question 9

Refer to the exhibit. The NSG is applied to a subnet containing Azure SQL databases. You notice that traffic from the internet to the databases is not being denied. What is the most likely reason?

Accepted Answer

The destinationAddressPrefix should be '*' instead of 'VirtualNetwork'. The NSG rule is not denying internet traffic because the destinationAddressPrefix is set to 'VirtualNetwork' instead of '*'. An NSG rule with destination 'VirtualNetwork' only matches traffic destined to addresses within the virtual network (and peered networks), so traffic from the internet to the SQL database's public endpoint does not match the Deny rule and is therefore allowed by default or by a lower-priority Allow rule. Changing the destination to '*' ensures the Deny rule matches all destinations, including the database's public IP.

Answer

The rule should be Allow to deny traffic

Answer

The priority of the Deny rule is too low (100)

Answer

The direction should be Outbound

Question 10

A global company with branches worldwide wants to secure access to Azure resources using a zero-trust approach. They require that all access requests be authenticated, authorized, and encrypted, and that the user's device must be compliant with corporate policies. Which combination of services should they use?

Accepted Answer

Azure AD Conditional Access and Azure AD Application Proxy. Microsoft Entra Conditional Access is the policy engine that enforces zero-trust access decisions by evaluating user identity, device compliance, location, and risk before granting access to Azure resources, while Microsoft Entra application proxy publishes internal applications for secure remote access with authentication and encryption, matching the requirement that all requests be authenticated, authorized, encrypted, and device-compliant. Together they satisfy the scenario's demand for conditional, policy-based access control with compliant devices. Azure VPN Gateway with MFA (A) provides encrypted tunnel access and strong authentication but does not by itself enforce device compliance-based conditional authorization for Azure resources. Azure Firewall and Microsoft Entra ID Password Protection (C) address network filtering and password hygiene, not zero-trust access authorization or device compliance. Azure AD B2C and Microsoft Entra ID Protection (D) focus on customer identity and risk detection, not on publishing apps with conditional access enforcement for corporate Azure resources.

Answer

Azure VPN Gateway and Azure AD Multi-Factor Authentication

Answer

Azure Firewall and Azure AD Password Protection

Answer

Azure AD B2C and Azure AD Identity Protection

Question 11

Your organization uses Azure SQL Database with Azure AD authentication. You need to ensure that database administrators (DBAs) can only perform management tasks from a specific Azure region and only during business hours. Which solution should you use?

Accepted Answer

Azure AD Conditional Access policies. Microsoft Entra Conditional Access policies are the correct solution because they can enforce both location-based (named locations/regions) and time-based (sign-in frequency, or via authentication context combined with Conditional Access) conditions on sign-ins to Azure SQL Database when Microsoft Entra ID authentication is used. This directly satisfies the requirement that DBAs perform management tasks only from a specific Azure region and only during business hours. Azure RBAC with custom roles (B) only controls what actions a principal can perform, not when or from where they sign in. Azure Policy (C) governs resource configuration and compliance, not user sign-in conditions. Azure SQL Database firewall rules (D) restrict network access by IP range but cannot enforce business-hours time restrictions.

Answer

Azure RBAC with custom roles

Answer

Azure Policy with custom policy

Answer

Azure SQL Database firewall rules

Question 12

Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to ensure that user passwords are synchronized securely and that password changes on-premises are reflected in the cloud quickly. Which tool should you configure?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect (option A) is the correct tool because it provides directory synchronization between on-premises Active Directory and Microsoft Entra ID, including secure password hash synchronization, and it can be configured with password writeback or password hash synchronization so that on-premises password changes are reflected in the cloud quickly. It is the current, supported synchronization tool for hybrid identity in Entra ID. Microsoft Entra Connect (option B) is the former name of the same product and is not the current correct designation in this scenario. AD FS (option C) provides federated authentication and does not synchronize passwords. Microsoft Identity Manager (option D) is a separate identity management product and is not the standard tool for Entra ID password synchronization.

Answer

Azure AD Connect

Answer

Active Directory Federation Services (AD FS)

Answer

Microsoft Identity Manager

Question 13

You are designing a network security solution for a multi-tier application in Azure that must meet PCI DSS compliance. You need to restrict traffic between tiers to only necessary ports and protocols. You also need to log all denied traffic for auditing. What is the most efficient design?

Accepted Answer

Deploy Azure Firewall in a hub virtual network. Use application rules to allow specific FQDNs between tiers. Enable diagnostic logs and send them to a Log Analytics workspace.. Azure Firewall in a hub virtual network provides centralized, stateful traffic filtering with application rules (FQDN-based) and network rules (IP/port/protocol), and its diagnostic logs can be sent to Log Analytics to capture denied traffic for PCI DSS auditing. This hub-and-spoke design is the most efficient for a multi-tier application since policy is managed in one place rather than per-subnet. NSGs (option B) can filter by IP and port and NSG flow logs record flows, but flow logs are not designed to log every denied connection with application-layer context, and managing NSGs across many subnets is less centralized. Application Gateway with WAF (option A) is a Layer 7 HTTP/HTTPS reverse proxy for inbound web traffic, not a general inter-tier firewall, so it cannot restrict arbitrary ports/protocols between tiers. A third-party NVA (option D) can filter traffic but adds licensing, management, and scaling overhead, making it less efficient than the native Azure Firewall.

Answer

Deploy Azure Application Gateway in front of each tier. Use WAF policies to filter traffic.

Answer

Use network security groups (NSGs) on each subnet to allow/deny traffic by IP and port. Enable NSG flow logs for auditing.

Answer

Deploy a third-party NVA (e.g., Palo Alto) in the hub. Configure inter-tier routing through the NVA.

Question 14

Refer to the exhibit. You are reviewing an Azure Policy definition. What does this policy do?

Accepted Answer

Denies creation of any virtual machine that is attached to a public IP address.. The correct option is B: the policy denies creation of any virtual machine that is attached to a public IP address. In the exhibit, the policy rule evaluates the Microsoft.Network/publicIPAddresses resource type and uses a deny effect when a public IP address is associated with the VM's network interface, which blocks VMs from being deployed with direct public IP exposure. Option A is incorrect because the policy does not target a specific subnet, and option C is incorrect because it does not require the presence of a network interface. Option D is also incorrect because the policy does not allow VMs only when attached to a specific subnet; it simply denies VMs that have a public IP address.

Answer

Denies creation of any virtual machine that has a network interface attached to a specific subnet.

Answer

Denies creation of any virtual machine that does not have a network interface.

Answer

Allows creation of virtual machines only if they have a network interface attached to a specific subnet.

Question 15

Your company uses Microsoft Defender for Cloud to manage security across multiple subscriptions. You need to ensure that all subscriptions have at least one Defender plan enabled, and you want to enforce this centrally using Azure Policy. What is the best approach?

Accepted Answer

Create an Azure Policy that audits subscriptions without any Defender plans and then use a remediation task to enable the required plans.. Option D is correct because Azure Policy can audit subscriptions lacking any Defender plan via a policy definition with an Audit effect, and then a remediation task can deploy the required Defender plans (using a deployIfNotExists effect) to bring them into compliance centrally. This matches the scenario's need to enforce at least one Defender plan across all subscriptions. Option A does not enforce anything; continuous export only streams data to a Log Analytics workspace. Option B is impractical because Azure Policy cannot deny the creation of subscriptions, and subscription creation is not a resource operation Azure Policy evaluates that way. Option C is wrong because Azure Blueprints assign artifacts at management-group or subscription scope during assignment and cannot retroactively enforce Defender plans across existing subscriptions.

Answer

Use the Defender for Cloud continuous export feature to send compliance data to a Log Analytics workspace and create alerts.

Answer

Create an Azure Policy that denies creation of subscriptions that do not have Defender plans enabled.

Answer

Use Azure Blueprints to assign Defender plans to all subscriptions.