SC-100 Design security solutions for infrastructure Practice Test 6 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing an Azure Policy definition. What is the effect of this policy?

Accepted Answer

Denies creation of Windows VMs without automatic updates enabled. The policy denies the creation of Windows virtual machines that do not have automatic updates enabled. Option A is incorrect because the effect is deny, not audit. Option B is incorrect because the effect is deny, not audit, and the policy denies VMs without automatic updates, not audits those with disabled updates. Option C is incorrect because the policy targets Windows VMs, not Linux.

Answer

Denies creation of Windows VMs that have automatic updates enabled

Answer

Audits Windows VMs that have automatic updates disabled

Answer

Audits Linux VMs that have automatic updates enabled

Question 2

Refer to the exhibit. You review a PowerShell script that configures an NSG rule. What is the likely security issue with this rule?

Accepted Answer

The destination address prefix is 'VirtualNetwork' which allows traffic to all VMs. The rule allows HTTP (port 80) from the Internet to the VirtualNetwork address prefix, which effectively allows inbound traffic from any public IP to all VMs in the virtual network on port 80. This is overly permissive. Option A is wrong because the source address prefix is 'Internet', which is overly broad; it should be a specific IP range for proper security. Option B is wrong because the rule allows HTTP (port 80), not HTTPS. Option C is wrong because the rule is inbound, not outbound.

Answer

The source address prefix should be a specific IP range

Answer

The rule allows HTTPS instead of HTTP

Answer

The rule is outbound but should be inbound

Question 3

Refer to the exhibit. A KQL query in Microsoft Sentinel is used to detect potential brute-force attacks. What does this query detect?

Accepted Answer

Successful remote logon attempts from a single IP exceeding 10. The query filters for successful logon events (4624) with LogonType 10 (remote interactive), then summarizes by IP address, filters for more than 10 attempts, and projects the IP address. This detects potential brute-force attacks from a single IP. Option A is wrong because the query looks for successful logons, not local logons from multiple accounts. Option B is wrong because the query filters for successful logons, not failed attempts. Option D is wrong because the query counts successful logons, not failed attempts.

Answer

Local logon attempts from multiple accounts

Answer

Failed logon attempts from multiple IPs

Answer

Failed logon attempts from a single IP

Question 4

A company is designing a security solution for their hybrid infrastructure that includes on-premises servers and Azure virtual machines. They need to ensure that all administrative access to servers is just-in-time (JIT) and just-enough-administration (JEA). Which Azure service should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides JIT VM access and JEA capabilities through Azure Arc for on-premises servers, making it the correct choice. Azure AD Privileged Identity Management (PIM) is for user roles, not server access. Azure Bastion provides secure RDP/SSH access but not JIT. Azure Policy is for compliance, not JIT access.

Answer

Azure Bastion

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Azure Policy

Question 5

A global enterprise uses Azure Firewall and Azure Virtual Network Manager (AVNM) to manage network security. They want to deploy a new spoke virtual network that must be isolated from all other spokes except one specific shared services hub. The hub uses Azure Firewall to inspect traffic. What is the most secure and scalable way to enforce this isolation?

Accepted Answer

Use AVNM to create a network group for the new spoke and apply security admin rules to block inter-spoke traffic except to the hub.. Using AVNM connectivity and security admin rules allows central management of network groups and firewall policies, ensuring isolation while scaling. Direct peering with route tables is less scalable and lacks central management. NSG on the subnet is not scalable and can be overridden. Enforcing via Azure Policy with deny is possible but less integrated for network topology.

Answer

Apply a custom Azure Policy definition that denies VNet peering between the new spoke and any VNet other than the hub.

Answer

Configure direct VNet peering between the new spoke and the hub, and use route tables to block traffic to other spokes.

Answer

Deploy a network virtual appliance (NVA) in the new spoke and route all traffic through it.

Question 6

A company plans to migrate their on-premises Active Directory to Microsoft Entra ID. They need to ensure that legacy applications using NTLM authentication continue to work during the transition. What should they configure?

Accepted Answer

Microsoft Entra Connect with PTA and enable NTLM support for on-premises applications. Microsoft Entra Connect syncs identities and can be configured to allow NTLM authentication for hybrid identities. PTA or ADFS are for authentication, but not specifically for NTLM support. PHS alone doesn't handle NTLM. Cloud Kerberos trust is for Kerberos, not NTLM.

Answer

Microsoft Entra Connect with password hash synchronization (PHS) and seamless single sign-on (SSO)

Answer

Microsoft Entra Connect with Active Directory Federation Services (AD FS)

Answer

Microsoft Entra Connect with pass-through authentication (PTA)

Question 7

An organization uses Microsoft Sentinel to monitor their hybrid infrastructure. They need to detect brute-force attacks against their on-premises Windows servers. Which data source should they connect to Sentinel?

Accepted Answer

Windows Security Events via Azure Monitor Agent. Windows Security Events from Event ID 4625 (failed logon) are the primary source for detecting brute-force attacks. Azure Activity Log is for resource management events. DNS events are for DNS queries. Sysmon is for process activity, not logon failures.

Answer

Azure Activity Log

Answer

DNS Events

Answer

Sysmon Events

Question 8

A multinational corporation is designing a secure infrastructure for their Azure Kubernetes Service (AKS) clusters. They require network policies to restrict pod-to-pod communication based on namespaces and label selectors. They also need to integrate with Azure Policy for compliance. Which network policy engine should they use?

Accepted Answer

Calico through Azure Policy add-on. Azure Policy for AKS supports the Calico network policy engine for advanced network policies. Cilium is not natively integrated with Azure Policy. Azure Firewall is for cluster ingress/egress, not pod-level policies. kubenet is a basic networking plugin that does not support network policies.

Answer

kubenet

Answer

Cilium

Answer

Azure Firewall

Question 9

A small business uses Microsoft 365 Business Premium and wants to secure their Windows 10 devices with Microsoft Intune. They need to ensure that only devices compliant with the company's security policies can access corporate email. What should they configure?

Accepted Answer

Conditional Access policy requiring compliant device. Conditional Access in Microsoft Entra ID can require device compliance before granting access to Exchange Online. Device compliance policies in Intune define the security requirements. Azure AD Application Proxy is for on-prem apps. Microsoft Defender for Cloud Apps is for cloud app security. Windows Defender Firewall is for network security.

Answer

Azure AD Application Proxy

Answer

Windows Defender Firewall rules

Answer

Microsoft Defender for Cloud Apps session policy

Question 10

A company uses Azure Front Door to publish a web application globally. They need to protect against DDoS attacks and web application attacks (SQL injection, XSS). Which two services should they enable in combination?

Accepted Answer

Azure DDoS Protection Standard and Azure WAF policy on Front Door. Azure DDoS Protection protects against volumetric DDoS attacks. Azure Web Application Firewall (WAF) in Front Door protects against application-layer attacks. Azure Firewall is for network-layer filtering. Network Security Groups (NSGs) are for subnet-level filtering. Azure DDoS Protection Standard is the correct tier.

Answer

Azure DDoS Protection Standard and Azure Firewall

Answer

Azure WAF on Application Gateway and Network Security Groups

Answer

Azure Firewall and Azure DDoS Protection Basic

Question 11

A financial services company is designing a secure infrastructure for their Azure SQL Database. They need to encrypt data at rest using customer-managed keys (CMK) stored in a key vault with soft-delete and purge protection enabled. The encryption must be transparent to applications. What should they configure?

Accepted Answer

Transparent Data Encryption (TDE) with Azure Key Vault. Azure SQL Database supports Transparent Data Encryption (TDE) with CMK in Azure Key Vault. Always Encrypted is for column-level encryption. Dynamic Data Masking is for masking, not encryption. Azure Information Protection is for classification.

Answer

Azure Information Protection

Answer

Dynamic Data Masking

Answer

Always Encrypted

Question 12

A company uses Microsoft Defender for Cloud to assess the security posture of their Azure subscriptions. They want to receive alerts when a resource is deployed without encryption enabled. What should they configure?

Accepted Answer

Azure Policy definition to audit or deny resources without encryption. Azure Policy with a custom policy definition can audit or deny resources without encryption. Defender for Cloud's regulatory compliance dashboard shows compliance status. Security alerts are for threats, not configuration drift. Azure Blueprints are for packaging resources.

Answer

Azure Blueprints

Answer

Microsoft Defender for Cloud regulatory compliance dashboard

Answer

Microsoft Defender for Cloud security alerts

Question 13

Which TWO actions should you take to secure Azure SQL Database against SQL injection attacks?

Accepted Answer

Enable Azure Web Application Firewall (WAF) on Application Gateway. Using parameterized queries in stored procedures prevents SQL injection by separating SQL code from data. Enabling Azure WAF on Application Gateway filters malicious requests at the network edge. Row-Level Security is for access control, not injection. Always Encrypted protects data at rest. Dynamic Data Masking obfuscates data.

Answer

Implement Always Encrypted

Answer

Enable Row-Level Security (RLS)

Answer

Apply Dynamic Data Masking

Question 14

Which THREE components are required to implement a zero-trust network architecture in Azure using Microsoft security solutions?

Accepted Answer

Microsoft Defender for Cloud Apps. Azure AD Conditional Access enforces access policies. Microsoft Defender for Cloud Apps provides cloud access security broker (CASB) functionality. Azure Policy ensures compliance. Azure Bastion is for secure connectivity. Microsoft Sentinel is for SIEM, not a core zero-trust component.

Answer

Microsoft Sentinel

Answer

Azure Bastion

Question 15

Which ONE Azure service can be used to protect a virtual network from inbound DDoS attacks at the network layer?

Accepted Answer

Azure DDoS Protection Standard. Azure DDoS Protection Standard is the dedicated service for mitigating volumetric DDoS attacks at the network layer (L3/L4). It automatically monitors and scrubs traffic to protect virtual networks. Other services like Azure Firewall operate at higher layers or are not primary DDoS solutions; Azure Firewall may filter traffic but does not provide specialized DDoS mitigation. Therefore, only Azure DDoS Protection Standard is designed for network-layer DDoS protection.

Answer

Azure Web Application Firewall (WAF)

Answer

Azure Traffic Manager

Answer

Network Security Groups (NSGs)

Answer

Azure Firewall