SC-100 Design security solutions for infrastructure Practice Test 5 — 15 Questions

Question 1

Refer to the exhibit. You run the PowerShell script to apply an NSG to a subnet. However, connectivity tests show that the NSG rule is not being applied. What is the most likely reason?

Accepted Answer

The script is missing the Set-AzVirtualNetwork call after updating the subnet.. Option D is correct because after modifying the subnet configuration with Set-AzVirtualNetworkSubnetConfig, you must apply the changes using Set-AzVirtualNetwork to update the VNet. Without that, the NSG association is not saved. Option A is wrong because the NSG is created and associated to the subnet, but the VNet update is missing. Option B is wrong because the priority is valid. Option C is wrong because the NSG is applied to the subnet, not the NIC.

Answer

The NSG was not associated to the subnet; Set-AzVirtualNetworkSubnetConfig does not associate the NSG.

Answer

The rule priority 100 conflicts with an existing rule with lower priority.

Answer

The NSG should be associated to the network interface instead of the subnet.

Question 2

You need to secure Azure Blob Storage by encrypting data at rest using customer-managed keys stored in Azure Key Vault. What should you configure?

Accepted Answer

Configure encryption with customer-managed keys in Azure Key Vault and enable infrastructure encryption.. Option C is correct because Azure Storage encryption with customer-managed keys uses Key Vault and requires enabling 'Infrastructure encryption' for double encryption. Option A is wrong because Azure Information Protection is for classification, not storage encryption. Option B is wrong because Azure Disk Encryption is for VM disks. Option D is wrong because Azure Purview is for data governance, not encryption.

Answer

Enable Azure Purview to manage encryption keys.

Answer

Enable Azure Disk Encryption for the storage account.

Answer

Enable Azure Information Protection for the storage account.

Question 3

Which TWO actions should you take to protect Azure Virtual Machines from ransomware? (Choose two.)

Accepted Answer

Enable Azure Backup with immutable vault.. Option A is correct because Azure Backup provides immutable backups that cannot be deleted, protecting against ransomware. Option C is correct because Microsoft Defender for Servers (in Defender for Cloud) provides threat detection and alerts for ransomware. Option B is wrong because Azure Site Recovery is for disaster recovery, not backup. Option D is wrong because Azure Firewall is a network firewall, not a backup or detection solution. Option E is wrong because Azure Policy enforces compliance, not direct ransomware protection.

Answer

Deploy Azure Firewall to block all inbound traffic.

Answer

Configure Azure Site Recovery for all VMs.

Answer

Assign Azure Policy to require encryption at rest.

Question 4

Which THREE components are required to implement a secure Azure DevOps CI/CD pipeline that scans for secrets in code? (Choose three.)

Accepted Answer

GitHub Advanced Security for secret scanning.. Option B is correct because GitHub Advanced Security includes secret scanning for code repositories. Option C is correct because Azure Key Vault can store secrets accessed during pipeline execution. Option D is correct because Credential Scanner is a Microsoft security tool that is integrated into Azure DevOps for scanning secrets. Option A is wrong because Azure Artifacts is a package management solution. Option E is wrong because Azure Boards is for work item tracking.

Answer

Azure Artifacts to store packages.

Answer

Azure Boards for tracking security issues.

Question 5

Which TWO Microsoft Purview solutions should you use to protect sensitive data in Microsoft 365? (Choose two.)

Accepted Answer

Sensitivity labels and policies.. Option A is correct because Data Loss Prevention (DLP) policies prevent sensitive data from being shared inappropriately. Option B is correct because Sensitivity Labels classify and protect data across M365. Option C is wrong because Insider Risk Management detects risky user activities but does not directly protect data. Option D is wrong because eDiscovery is for legal discovery. Option E is wrong because Audit logs track activities but do not protect data.

Answer

Microsoft Purview Audit.

Answer

Insider Risk Management.

Answer

Microsoft Purview eDiscovery.

Question 6

You are designing security for a multi-region Azure application. You need to ensure that traffic between virtual networks in different regions is encrypted and uses Microsoft backbone. What should you implement?

Accepted Answer

Configure VNet peering with 'Allow gateway transit' and 'Use remote gateways'.. Option B is correct because VNet peering with 'Use Remote Gateway' enables encrypted transit over Microsoft backbone. Option A is wrong because VPN Gateway is for on-premises or inter-region VPN over internet, not using backbone. Option C is wrong because ExpressRoute is for on-premises to Azure, not VNet-to-VNet. Option D is wrong because Azure Firewall can inspect traffic but does not provide encrypted peering.

Answer

Use Azure Firewall in each VNet and route traffic through it.

Answer

Deploy ExpressRoute circuits and connect each VNet to them.

Answer

Deploy a site-to-site VPN between the virtual networks.

Question 7

Refer to the exhibit. You are deploying an ARM template for a Windows VM. The adminPassword parameter references a secret in Key Vault. However, the deployment fails with an access denied error. What is the most likely cause?

Accepted Answer

The deployment principal lacks 'Get' and 'List' permissions on the Key Vault secret.. Option C is correct because when referencing a Key Vault secret in an ARM template parameter, the user or service principal deploying the template must have 'Get' and 'List' permissions on the secret. If the deployment principal does not have those permissions, access is denied. Option A is wrong because secrets can be used as strings. Option B is wrong because the resource group is specified, and if the KV is in a different resource group, it's fine as long as permissions are granted. Option D is wrong because the template uses a parameter reference, not a direct secret value.

Answer

The secret value contains special characters that need to be escaped.

Answer

The template should use the secret's URI directly instead of a parameter reference.

Answer

The Key Vault is in a different resource group than the deployment.

Question 8

Your company is deploying Microsoft Sentinel to centralize security logs from Azure, on-premises, and other clouds. You need to ensure logs are ingested cost-effectively while maintaining search performance for the last 30 days. What should you configure?

Accepted Answer

Use Log Analytics workspace with 30-day interactive retention and set long-term retention for older data.. Option D is correct because Sentinel uses Log Analytics workspaces; you can set interactive retention to 30 days and long-term retention to lower-cost archival. Option A is wrong because Azure Storage is not optimized for log analytics queries. Option B is wrong because Sentinel cost is based on data ingestion, not separate tiers. Option C is wrong because Azure Event Hubs is for real-time streaming, not cost-effective storage.

Answer

Store logs in Azure Blob Storage and use Azure Data Explorer for queries.

Answer

Use Sentinel's free tier for 30 days and then move to paid tier.

Answer

Ingest logs into Azure Event Hubs and then into Sentinel.

Question 9

Your organization is deploying a new web application in Azure and needs to secure it against common web attacks like SQL injection and cross-site scripting. You need to configure a solution that provides centralized protection at the network edge. Which Azure service should you use?

Accepted Answer

Azure Web Application Firewall (WAF) on Azure Application Gateway. Option A is correct because Azure Web Application Firewall (WAF) with Application Gateway provides centralized protection against common web exploits at the network edge. Option B is wrong because Azure Firewall is a network firewall but doesn't have web-specific filtering. Option C is wrong because Azure DDoS Protection only mitigates DDoS attacks. Option D is wrong because Network Security Groups provide basic network filtering but not web application layer protection.

Answer

Network Security Groups (NSGs)

Answer

Azure DDoS Protection

Answer

Azure Firewall

Question 10

You are designing a secure hybrid network architecture that connects an on-premises data center to Azure. The requirements include: encrypted traffic, high availability across two Azure regions, and automatic failover. You need to recommend a connectivity solution that meets these requirements. What should you use?

Accepted Answer

Azure ExpressRoute with VPN gateway failover. Option D is correct because ExpressRoute with VPN gateway failover provides encrypted connectivity with high availability and automatic failover across regions. Option A is wrong because Site-to-Site VPN alone may not meet high availability requirements. Option B is wrong because ExpressRoute alone does not encrypt traffic by default. Option C is wrong because Point-to-Site VPN is for individual clients, not site-to-site.

Answer

Azure Point-to-Site VPN

Answer

Azure Site-to-Site VPN with active-passive configuration

Answer

Azure ExpressRoute with Microsoft Peering

Question 11

Your company uses Azure Virtual Machines (VMs) running Windows Server. You need to ensure that only approved applications can run on the VMs. Which Azure security feature should you use?

Accepted Answer

Azure Policy with application control. Option C is correct because Azure Policy with application control can enforce allowed applications. Option A is wrong because Microsoft Defender for Cloud provides threat detection but not application whitelisting. Option B is wrong because Azure Firewall is a network firewall. Option D is wrong because Just-in-Time VM access controls remote access, not applications.

Answer

Azure Firewall

Answer

Microsoft Defender for Cloud

Answer

Just-in-Time VM access

Question 12

You are designing a security solution for containers running on Azure Kubernetes Service (AKS). The requirements include: scanning container images for vulnerabilities, enforcing runtime security, and generating alerts for suspicious activities. Which combination of services should you use?

Accepted Answer

Microsoft Defender for Cloud with Defender for Containers plan. Option B is correct because Microsoft Defender for Containers provides image scanning and runtime threat detection integrated with AKS. Option A is wrong because Azure Security Center is now part of Defender for Cloud but the specific plan is Defender for Containers. Option C is wrong because Azure Policy can enforce configurations but not runtime security. Option D is wrong because Azure Container Registry provides image storage, not scanning.

Answer

Azure Security Center and Azure Policy

Answer

Azure Container Registry and Azure Monitor

Answer

Azure Policy and Azure Firewall

Question 13

Your organization has a Microsoft 365 E5 subscription and uses Microsoft Entra ID for identity. You need to implement a solution to secure privileged access to Azure resources, requiring just-in-time access and approval workflows. What should you configure?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM). Option A is correct because Microsoft Entra Privileged Identity Management (PIM) provides just-in-time access and approval workflows for Azure roles. Option B is wrong because Conditional Access controls access based on conditions, not just-in-time role activation. Option C is wrong because Azure AD (now Entra ID) roles are managed by PIM. Option D is wrong because Microsoft Defender for Identity identifies threats to on-premises Active Directory.

Answer

Microsoft Defender for Identity

Answer

Azure AD administrative units

Answer

Microsoft Entra Conditional Access

Question 14

You are designing a security solution for Azure SQL Database. The requirements include: encrypting data at rest and in transit, and masking sensitive data from non-privileged users. Which two features should you implement? (Choose two.)

Accepted Answer

Dynamic Data Masking. Options A and B are correct: TDE encrypts data at rest, and Dynamic Data Masking hides sensitive data from non-privileged users. Option C is wrong because Always Encrypted protects data in transit between client and server but does not mask data. Option D is wrong because Azure Firewall is a network security service, not a database feature. Option E is wrong because Transparent Data Encryption is at rest, not column-level.

Answer

Azure Firewall

Answer

Column-level encryption

Answer

Always Encrypted

Question 15

Your company uses Azure DevOps to manage CI/CD pipelines. You need to ensure that secrets such as API keys are securely stored and automatically injected into pipeline tasks without being exposed in logs. What should you use?

Accepted Answer

Azure Key Vault linked to Azure DevOps. Option B is correct because Azure Key Vault securely stores secrets and Azure DevOps can retrieve them without exposing secrets in logs. Option A is wrong because Azure App Configuration is for application configuration, not secrets. Option C is wrong because variable groups can store secrets but they are not as secure as Key Vault. Option D is wrong because Azure Policy is for governance, not secret management.

Answer

Azure DevOps variable groups

Answer

Azure App Configuration

Answer

Azure Policy

SC-100 Design security solutions for infrastructure Practice Test 5 — 15 Questions

Exhibit

SC-100 Design security solutions for infrastructure Practice Test 5 — 15 Questions

Exhibit