SC-100 Design security solutions for infrastructure Practice Test 5 — 15 Questions

Question 1

You are designing security for a multi-region Azure application. You need to ensure that traffic between virtual networks in different regions is encrypted and uses Microsoft backbone. What should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a site-to-site VPN between the virtual networks.. To encrypt traffic between VNets while keeping it on the Microsoft backbone, deploy a VNet-to-VNet site-to-site VPN (VPN gateways in each VNet configured as an S2S/VNet-to-VNet connection). This uses IPsec to encrypt the traffic and, since both endpoints are in Azure, the tunneled traffic traverses the Microsoft backbone. VNet peering itself provides private connectivity over the Microsoft backbone but no encryption; 'Allow gateway transit'/'Use remote gateways' only lets a peered VNet use the remote VPN gateway for connections to other networks, not for encrypting peering traffic. ExpressRoute is for connecting on-premises networks, and Azure Firewall inspects but does not encrypt transit.

Answer

Configure VNet peering with 'Allow gateway transit' and 'Use remote gateways'.

Answer

Use Azure Firewall in each VNet and route traffic through it.

Answer

Deploy ExpressRoute circuits and connect each VNet to them.

Question 2

Refer to the exhibit. You are deploying an ARM template for a Windows VM. The adminPassword parameter references a secret in Key Vault. However, the deployment fails with an access denied error. What is the most likely cause?

Accepted Answer

The deployment principal lacks 'Get' and 'List' permissions on the Key Vault secret.. When referencing a Key Vault secret in an ARM template parameter, the user or service principal deploying the template must have 'Get' and 'List' permissions on the secret. If the deployment principal does not have those permissions, access is denied. Option A is wrong because special characters in secrets are supported, but the deployment still requires permissions. Option B is wrong because the template uses a parameter reference to the secret, not the secret's URI directly; that is the correct approach. Option D is wrong because the Key Vault can be in a different resource group than the deployment, as long as the deployment principal has the necessary permissions.

Answer

The secret value contains special characters that need to be escaped.

Answer

The template should use the secret's URI directly instead of a parameter reference.

Answer

The Key Vault is in a different resource group than the deployment.

Question 3

Your company is deploying Microsoft Sentinel to centralize security logs from Azure, on-premises, and other clouds. You need to ensure logs are ingested cost-effectively while maintaining search performance for the last 30 days. What should you configure?

Accepted Answer

Use Log Analytics workspace with 30-day interactive retention and set long-term retention for older data.. Microsoft Sentinel utilizes a Log Analytics workspace for log storage and querying. You can configure interactive retention to keep data readily accessible for queries for up to 30 days (for most tiers), and then set long-term retention (up to 7 years) at a lower cost for archival purposes. This balances cost-effectiveness with query performance for recent data. Option A is incorrect: Azure Blob Storage is not optimized for log analytics queries and lacks the powerful KQL query engine. Option C is incorrect: Sentinel does not have a 'free tier'; pricing is based on data ingestion volume. Option D is incorrect: Azure Event Hubs is a real-time streaming service, not a cost-effective storage solution for log retention.

Answer

Store logs in Azure Blob Storage and use Azure Data Explorer for queries.

Answer

Use Sentinel's free tier for 30 days and then move to paid tier.

Answer

Ingest logs into Azure Event Hubs and then into Sentinel.

Question 4

Your organization is deploying a new web application in Azure and needs to secure it against common web attacks like SQL injection and cross-site scripting. You need to configure a solution that provides centralized protection at the network edge. Which Azure service should you use?

Accepted Answer

Azure Web Application Firewall (WAF) on Azure Application Gateway. Azure Web Application Firewall (WAF) with Application Gateway provides centralized protection against common web exploits at the network edge. Option B is wrong because Network Security Groups provide basic network filtering but not web application layer protection. Option C is wrong because Azure DDoS Protection only mitigates DDoS attacks. Option D is wrong because Azure Firewall is a network firewall but doesn't have web-specific filtering.

Answer

Network Security Groups (NSGs)

Answer

Azure DDoS Protection

Answer

Azure Firewall

Question 5

You are designing a secure hybrid network architecture that connects an on-premises data center to Azure. The requirements include: encrypted traffic, high availability across two Azure regions, and automatic failover. You need to recommend a connectivity solution that meets these requirements. What should you use?

Accepted Answer

Azure ExpressRoute with VPN gateway failover. ExpressRoute with VPN gateway failover provides encrypted connectivity, high availability across regions, and automatic failover. Option A is wrong because Point-to-Site VPN is designed for individual client connections, not site-to-site connectivity, and does not meet high availability requirements. Option C is wrong because a Site-to-Site VPN with active-passive configuration may not provide automatic failover and may not ensure high availability across regions. Option D is wrong because ExpressRoute with Microsoft Peering does not encrypt traffic by default and does not inherently provide failover.

Answer

Azure Point-to-Site VPN

Answer

Azure Site-to-Site VPN with active-passive configuration

Answer

Azure ExpressRoute with Microsoft Peering

Question 6

Your company uses Azure Virtual Machines (VMs) running Windows Server. You need to ensure that only approved applications can run on the VMs. Which Azure security feature should you use?

Accepted Answer

Azure Policy with application control. Azure Policy with application control (often implemented via AppLocker or Windows Defender Application Control) allows you to define policies that restrict which applications can run on your VMs, enforcing an allowlist. Option A is incorrect because Azure Firewall is a network firewall that filters traffic based on IP/port, not application execution. Option C is incorrect because Microsoft Defender for Cloud provides security recommendations and threat detection but does not directly control which applications can run. Option D is incorrect because Just-in-Time VM access reduces the attack surface by limiting remote access to management ports, not by controlling applications.

Answer

Azure Firewall

Answer

Microsoft Defender for Cloud

Answer

Just-in-Time VM access

Question 7

You are designing a security solution for containers running on Azure Kubernetes Service (AKS). The requirements include: scanning container images for vulnerabilities, enforcing runtime security, and generating alerts for suspicious activities. Which combination of services should you use?

Accepted Answer

Microsoft Defender for Cloud with Defender for Containers plan. Microsoft Defender for Cloud with the Defender for Containers plan provides container image vulnerability scanning, runtime threat detection, and alerts for suspicious activities in AKS. Option A is wrong because Azure Security Center (now part of Defender for Cloud) without the Defender for Containers plan does not provide container-specific runtime security. Option B is wrong because Azure Container Registry stores images but does not scan them by default, and Azure Monitor provides observability but not security threat detection. Option C is wrong because Azure Policy enforces configuration compliance but cannot detect runtime threats.

Answer

Azure Security Center and Azure Policy

Answer

Azure Container Registry and Azure Monitor

Answer

Azure Policy and Azure Firewall

Question 8

Your organization has a Microsoft 365 E5 subscription and uses Microsoft Entra ID for identity. You need to implement a solution to secure privileged access to Azure resources, requiring just-in-time access and approval workflows. What should you configure?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM). Microsoft Entra Privileged Identity Management (PIM) provides just-in-time access and approval workflows for Azure roles. Option A is incorrect because Microsoft Defender for Identity is a security solution for detecting threats to on-premises Active Directory, not for managing privileged access. Option B is incorrect because Azure AD administrative units are used to delegate administrative tasks over subsets of users or groups, not for just-in-time access. Option C is incorrect because Microsoft Entra Conditional Access controls access based on conditions like location or device, not for role activation workflows.

Answer

Microsoft Defender for Identity

Answer

Azure AD administrative units

Answer

Microsoft Entra Conditional Access

Question 9

You are designing a security solution for Azure SQL Database. The requirements include: encrypting data at rest and in transit, and masking sensitive data from non-privileged users. Which two features should you implement? (Choose two.)

Accepted Answer

Dynamic Data Masking. The correct answers are A (Dynamic Data Masking) and C (Transparent Data Encryption). TDE encrypts data at rest, and Dynamic Data Masking hides sensitive data from non-privileged users. Option B is incorrect because Azure Firewall is a network security service, not a database feature. Option D is incorrect because column-level encryption is not a built-in feature; it's often implemented via Always Encrypted. Option E is incorrect because Always Encrypted protects data in transit between client and server but does not mask data.

Answer

Azure Firewall

Answer

Column-level encryption

Answer

Always Encrypted

Question 10

Your company uses Azure DevOps to manage CI/CD pipelines. You need to ensure that secrets such as API keys are securely stored and automatically injected into pipeline tasks without being exposed in logs. What should you use?

Accepted Answer

Azure Key Vault linked to Azure DevOps. Azure Key Vault securely stores secrets and Azure DevOps can retrieve them without exposing secrets in logs. Option A is wrong because variable groups can store secrets but they are not as secure as Key Vault. Option C is wrong because Azure App Configuration is for application configuration, not secrets. Option D is wrong because Azure Policy is for governance, not secret management.

Answer

Azure DevOps variable groups

Answer

Azure App Configuration

Answer

Azure Policy

Question 11

You are designing a security solution for Azure API Management. The requirements include: protecting APIs from abuse, throttling requests, and validating JSON payloads. Which combination of features should you use?

Accepted Answer

Rate limiting policies, validate-json policy, and OAuth 2.0. Rate limiting policies throttle requests, validate-json policy validates JSON payloads, and OAuth 2.0 secures access. Option A is wrong because Managed Identities and Azure AD are for authentication and identity, not for throttling or JSON validation. Option B is wrong because WAF on Application Gateway protects against web exploits at the network edge but does not provide per-API throttling or JSON payload validation. Option D is wrong because Azure Firewall and NSGs provide network-level security and filtering, not API-level throttling or validation.

Answer

Managed Identities and Azure AD authentication

Answer

Azure Web Application Firewall (WAF) on Application Gateway

Answer

Azure Firewall and Network Security Groups

Question 12

Your organization is migrating on-premises Active Directory to Microsoft Entra ID. You need to ensure that users can authenticate to on-premises resources using their Entra ID credentials. Which feature should you implement?

Accepted Answer

Pass-through Authentication. Pass-through Authentication with Seamless Single Sign-On (SSO) allows users to authenticate to on-premises resources using their Microsoft Entra ID credentials. It validates passwords against on-premises Active Directory, enabling the same credentials to be used for both cloud and on-premises access without syncing password hashes. Password Hash Sync (Option B) only enables cloud authentication and does not directly support on-premises resource access. AD FS (Option A) relies on an on-premises identity provider and does not use Entra ID credentials directly. Entra Connect Health (Option C) is a monitoring tool, not an authentication mechanism.

Answer

Active Directory Federation Services (AD FS)

Answer

Password Hash Sync with Microsoft Entra Connect

Answer

Microsoft Entra Connect Health

Question 13

You need to design a solution to protect Azure VMs from malware and provide security recommendations. Which Azure service should you enable?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides antimalware and security recommendations. Option A is wrong because Azure Sentinel is a SIEM. Option B is wrong because Microsoft Intune manages endpoints. Option C is wrong because Azure Monitor collects logs.

Answer

Azure Sentinel

Answer

Microsoft Intune

Answer

Azure Monitor

Question 14

You are designing a secure access solution for an Azure App Service web application that authenticates users via Microsoft Entra ID. The requirements include: only allowing users from a specific Entra ID tenant, and blocking access from certain countries. Which two features should you combine? (Choose two.)

Accepted Answer

App Service authentication with Microsoft Entra ID. Options A and E are correct. App Service authentication with Microsoft Entra ID can be configured to allow only users from a specific Entra ID tenant by restricting the issuer URL. Azure Front Door with geo-filtering blocks requests from disallowed countries at the network edge. Option B is incorrect because NSGs filter IP traffic at the subnet/VM level, not user authentication or country-based access. Option C is incorrect because Microsoft Entra Conditional Access can apply policies based on user/device context but does not provide geo-filtering at the network edge. Option D is incorrect because Managed Identity is used for app-to-Azure resource authentication, not for user access control.

Answer

Network Security Groups (NSGs)

Answer

Microsoft Entra Conditional Access

Answer

Managed Identity

Question 15

Your company uses Azure Backup to protect VMs. You need to ensure that backup data is encrypted at rest and during transit. Which features should you enable? (Choose three.)

Accepted Answer

Azure Disk Encryption (BitLocker/DM-Crypt). Azure Backup provides encryption at rest via Storage Service Encryption (SSE) or customer-managed keys (Option B), and encryption in transit via HTTPS (Option C). Additionally, Azure Disk Encryption (Option A) encrypts the source VM disks, ensuring that backup data is also encrypted at rest on the source. Soft delete (Option E) protects against accidental deletion but does not encrypt data. Azure Information Protection (Option D) is for data classification and labeling, not backup encryption. Therefore, the correct three features are A, B, and C.

Answer

Azure Information Protection

Answer

Soft delete for Azure Backup