SC-100 Design security solutions for infrastructure Practice Test 6 — 15 Questions

Question 1

Your organization is planning to use Azure Bastion for secure RDP/SSH access to Azure VMs. You need to ensure that Bastion can reach the VMs in a spoke virtual network that is connected to a hub via VNet peering. The hub has an Azure Firewall. What is the minimal configuration required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy Azure Bastion in the hub VNet. Ensure the spoke VNet is peered to the hub VNet.. Option B is correct because Azure Bastion must be deployed in the hub VNet, and VNet peering between the hub and spoke allows Bastion to reach VMs in the spoke without additional public IPs or firewall rules. Azure Bastion uses the peered VNet connectivity to route RDP/SSH traffic to VMs in the spoke, and the Azure Firewall in the hub does not need to be configured for Bastion-to-VM traffic since that traffic stays within the Azure backbone via peering. Option A is wrong because assigning public IPs to VMs is unnecessary and defeats the purpose of Bastion. Option C is wrong because deploying Bastion in the spoke VNet does not meet the requirement of using the hub's Bastion, and Azure Firewall does not need to allow Bastion traffic. Option D is wrong because a route to the Bastion subnet is not required; VNet peering automatically provides the necessary connectivity.

Answer

Assign a public IP address to each VM. Deploy Azure Bastion in the hub VNet.

Answer

Deploy Azure Bastion in the spoke VNet. Configure Azure Firewall to allow traffic from Bastion to the VMs.

Answer

Deploy Azure Bastion in the hub VNet. Ensure the spoke VNet has a route to the Bastion subnet.

Question 2

Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You are designing a solution to protect against password spray attacks. You need to implement a solution that can detect and block malicious authentication attempts in real-time. What should you use?

Accepted Answer

Microsoft Entra ID Protection with Conditional Access policies.. Entra ID Identity Protection provides real-time risk detection and conditional access policies to block risky sign-ins, including password spray. Option B is wrong because Microsoft Defender for Identity focuses on on-premises AD attacks, not cloud authentication. Option C is wrong because Microsoft Entra ID MFA is a verification method, not a detection mechanism. Option D is wrong because password hash sync is for synchronization, not detection.

Answer

Microsoft Defender for Identity with a VPN integration.

Answer

Azure AD Multi-Factor Authentication (MFA) enforced for all users.

Answer

Password hash synchronization with Azure AD Connect.

Question 3

You are designing a secure CI/CD pipeline for Azure using GitHub Actions. You need to ensure that secrets (e.g., Azure service principal credentials) are stored securely and accessed only by authorized actions. What should you use?

Accepted Answer

Use GitHub Actions secrets to store the credentials.. GitHub Actions secrets are encrypted and provide a secure way to store sensitive information like Azure service principal credentials. They can be scoped to repositories, environments, or organization-level, ensuring only authorized workflows can access them. Option B is incorrect because managed identities cannot be directly used from GitHub Actions without an authentication mechanism like a service principal secret. Option C is incorrect because storing a secret in GitHub is still needed to access Key Vault, and using GitHub Secrets is the primary method. Option D is incorrect because environment variables in the repository are visible to anyone with repository access and are not encrypted.

Answer

Use Azure AD managed identities for GitHub Actions.

Answer

Store secrets in Azure Key Vault and access them using a service principal secret stored in GitHub.

Answer

Store secrets as environment variables in the GitHub repository.

Question 4

Your organization is designing a Microsoft Sentinel workspace for a multi-region deployment. You need to optimize cost while ensuring that security data is available for investigation in the primary region. Which TWO actions should you take?

Accepted Answer

Use a single Sentinel workspace in the primary region and ingest data from all regions via diagnostic settings.. The two actions that directly optimize cost for a multi-region Microsoft Sentinel deployment are consolidating logs into a single workspace in the primary region (Option A) and enabling the Azure Monitor Agent with data collection rules to filter logs (Option B).

Option A avoids duplicate ingestion and storage costs by centralizing all regional data into one workspace. 
Option B reduces the volume of data ingested, further lowering costs. 
Options C, D, and E either do not reduce costs or can increase them. Azure Lighthouse (Option C) only centralizes management and does not affect data volume or cost. Log Analytics clusters (Option D) require a high ingestion commitment and are not a universal cost-saving measure. Deploying separate workspaces in each region (Option E) duplicates data and costs.

Answer

Use Azure Lighthouse to manage multiple Sentinel workspaces from a single pane of glass.

Answer

Use Log Analytics clusters with dedicated clusters to reduce costs.

Answer

Deploy Sentinel workspaces in each region and use cross-workspace queries.

Question 5

You are designing a secure data exfiltration protection solution for Azure Storage accounts. You need to prevent data from being copied to unauthorized external locations. Which THREE controls should you implement?

Accepted Answer

Enable Microsoft Defender for Storage and configure alerts for anomalous data extraction.. Option A is correct because Microsoft Defender for Storage provides threat detection specifically for anomalous data access and exfiltration patterns (e.g., unusual volume extraction, access from suspicious IPs), generating alerts that let you detect and respond to unauthorized copying attempts. Option B is correct because Azure Firewall with application rules (FQDN-based Layer 7 filtering) enforces egress allow-listing, so outbound traffic from workloads can only reach approved external FQDNs and any attempt to send data to unauthorized destinations is blocked. Option C is correct because NSGs applied to subnets can deny outbound internet traffic, providing a network-layer egress control that prevents resources in those subnets from reaching external locations in the first place. Option D is not among the correct answers because Private Endpoints only secure inbound access to storage over a private IP and do not by themselves prevent data from being copied out to external destinations. Option E is not among the correct answers because soft delete and versioning are data-protection and recoverability features for blobs, not exfiltration-prevention controls.

Answer

Use Azure Private Endpoints for all storage accounts.

Answer

Enable soft delete and versioning for blobs.

Question 6

You are a security architect for a large financial services company. The company has a hybrid identity infrastructure with on-premises Active Directory and Microsoft Entra ID (Azure AD). They have recently suffered a password spray attack that compromised several accounts. Management wants to implement a Zero Trust security model and has mandated the following requirements: 1. All user authentication must be protected by phishing-resistant MFA. 2. Legacy authentication protocols must be blocked. 3. All sign-in risks must be detected and automatically remediated. The current environment includes: - Microsoft 365 E5 licenses for all users. - Microsoft Entra ID P2 licenses. - On-premises Active Directory with password hash sync. - Azure AD Application Proxy for publishing on-premises apps. - A third-party VPN solution for remote access. You need to design a solution that meets the requirements. What should you do?

Accepted Answer

Deploy Windows Hello for Business for all users. Configure Conditional Access policies to block legacy authentication and require MFA for all cloud apps. Use Entra ID Protection to detect risky sign-ins and automatically require password change or block access.. It satisfies all three mandates: Windows Hello for Business provides phishing-resistant MFA (FIDO2/WebAuthn-based asymmetric key authentication), Conditional Access blocks legacy authentication protocols (such as IMAP, POP3, SMTP AUTH, and older Office clients) and enforces MFA for all cloud apps, and Entra ID Protection (available with the P2 licenses) detects sign-in risk and automatically remediates it via risk-based Conditional Access policies that require password change or block access. Options A and B fail the phishing-resistant requirement because phone call MFA and OATH TOTP in the Authenticator app are both susceptible to real-time phishing and adversary-in-the-middle attacks. Option B also only alerts on risky sign-ins rather than automatically remediating them. Option C uses phishing-resistant FIDO2 keys and blocks legacy auth, but Identity Protection only sends alerts to the SOC instead of automatically remediating risk, so it does not meet the third requirement.

Answer

Enable Azure AD MFA with phone call for all users. Use Conditional Access to block legacy authentication. Use Identity Protection to detect risks and require MFA again.

Answer

Enable Azure AD MFA with the Microsoft Authenticator app (OATH TOTP). Use Conditional Access to block legacy authentication and require MFA. Configure Identity Protection to alert on risky sign-ins.

Answer

Deploy FIDO2 security keys to all users. Configure Conditional Access to block legacy authentication. Use Identity Protection to detect risks and send alerts to the SOC.

Question 7

A company is migrating its on-premises Active Directory to Microsoft Entra ID. They have line-of-business applications that use Windows Integrated Authentication. You need to design a solution that allows users to access these applications from domain-joined devices without prompting for credentials, while also supporting hybrid identity. What should you implement?

Accepted Answer

Configure Microsoft Entra hybrid join and enable Seamless SSO.. Option B is correct because Microsoft Entra hybrid join registers domain-joined Windows devices with Entra ID, and Seamless SSO (via the AZUREADSSOACC computer account and Kerberos) lets users on those devices obtain Entra ID tokens silently, enabling Windows Integrated Authentication to line-of-business apps without credential prompts while maintaining hybrid identity. Option A is wrong because Pass-through Authentication only validates on-premises passwords against Entra ID and does not by itself provide the device identity needed for silent WIA from domain-joined devices. Option C is wrong because Application Proxy publishes internal apps for remote access with pre-authentication, not silent WIA for domain-joined devices. Option D is wrong because AD FS is a federated identity provider that would add infrastructure and does not deliver the device-based silent SSO that hybrid join plus Seamless SSO provides.

Answer

Deploy Pass-through Authentication (PTA) with Seamless SSO.

Answer

Use Azure AD Application Proxy with pre-authentication.

Answer

Implement Active Directory Federation Services (AD FS).

Question 8

Your organization uses Microsoft Sentinel for security operations. You need to design a solution to detect and respond to lateral movement using pass-the-hash attacks. Which TWO data sources should you enable for ingestion into Microsoft Sentinel to detect such attacks?

Accepted Answer

Microsoft Defender for Identity alerts.. Correct answers: A and D. Option A: Microsoft Defender for Identity provides direct detection of pass-the-hash attacks. Option D: Windows Security Events (Event ID 4624) from domain controllers can reveal anomalous logon patterns indicative of pass-the-hash. Option B is incorrect because DNS events are not a primary source for detecting pass-the-hash; they might show network anomalies but not the attack itself. Option C is incorrect because Microsoft Entra ID sign-in logs do not capture on-premises NTLM authentication events required for pass-the-hash detection. Option E is incorrect because while Sysmon logs process creation, they are not specifically targeted at pass-the-hash; other data sources are more direct.

Answer

DNS events from DNS servers.

Answer

Azure AD sign-in logs.

Answer

Sysmon logs for process creation.

Question 9

You are designing a secure CI/CD pipeline for deploying infrastructure as code (ARM templates) to Azure. The solution must detect drift from the desired state and prevent deployment of non-compliant resources. Which THREE Azure services should you incorporate?

Accepted Answer

Azure Blueprints. Azure Blueprints (A) is correct because it packages ARM templates together with policy assignments and role assignments into a single governed definition, so every deployment of the blueprint enforces the desired compliant state and detects drift from that packaged definition. Azure DevOps with policy checks in pipeline (C) is correct because embedding policy evaluation (for example, via the Azure Policy compliance gate or az deployment group validate) into the CI/CD pipeline blocks non-compliant ARM template deployments before they reach Azure. Azure Policy (D) is correct because it evaluates resources against built-in or custom rules, reports compliance/drift from the desired state, and can deny or audit non-compliant resource deployments. Azure Monitor (B) is not correct because it collects metrics, logs, and alerts on running resources rather than enforcing infrastructure-as-code compliance or blocking deployments. Azure Resource Graph (E) is not correct because it is a read-only query service for inventory and exploration of resources, not a mechanism for preventing non-compliant deployments or enforcing desired state.

Answer

Azure Monitor

Answer

Azure Resource Graph

Question 10

A company wants to secure its Azure Kubernetes Service (AKS) cluster. They need to ensure that pods cannot communicate with each other unless explicitly allowed, and that secrets are encrypted at rest. Which TWO security controls should they implement?

Accepted Answer

Use Azure Key Vault with Secrets Store CSI driver for secret management.. Option C is correct because Kubernetes Network Policies (enforced in AKS via the Azure CNI or Calico network policy engine) provide pod-level ingress and egress rules, so pod-to-pod traffic is denied by default and only permitted when an explicit policy allows it, directly satisfying the 'cannot communicate unless explicitly allowed' requirement. Option A is correct because the Azure Key Vault provider for the Secrets Store CSI driver mounts Key Vault secrets, keys, and certificates into pods as a CSI volume, keeping secret material out of etcd and ensuring secrets are protected/encrypted at rest in Key Vault (which uses FIPS 140-2 validated HSMs and envelope encryption with customer-managed keys). Option B does not belong because Azure Policy restricting image sources is a supply-chain/registry governance control, not a pod-to-pod traffic or secret-encryption control. Option D does not belong because Container insights is a monitoring/observability feature (metrics and logs via Azure Monitor), not a preventive security control. Option E does not belong because Microsoft Entra ID integration provides authentication and RBAC authorization for cluster access, not pod-to-pod network segmentation or secret encryption at rest.

Answer

Apply Azure Policy to restrict container image sources.

Answer

Enable Container insights for monitoring.

Answer

Enable Azure AD integration for the AKS cluster.

Question 11

Your organization is a large financial services company with a hybrid infrastructure consisting of on-premises servers and Azure IaaS. You are tasked with designing a security solution for infrastructure that meets the following requirements: - All administrative access to Azure resources must be just-in-time (JIT) and just-enough-access (JEA). - All on-premises servers must be managed centrally with consistent security policies. - All network traffic between on-premises and Azure must be encrypted and inspected for threats. - All privileged access must be monitored and audited. You have the following services available: Microsoft Entra ID, Microsoft Defender for Cloud, Azure Firewall, Azure Bastion, Microsoft Sentinel, Azure Arc, Azure Policy, Microsoft Defender for Identity, and Microsoft Entra Privileged Identity Management (PIM). Which combination of services should you use to meet all requirements?

Accepted Answer

Use Microsoft Entra PIM for JIT access, Azure Arc to extend Azure Policy to on-prem servers, Azure Firewall with threat intelligence for traffic inspection, and Microsoft Defender for Identity for monitoring privileged access.. Option B is correct because Microsoft Entra Privileged Identity Management (PIM) provides just-in-time, just-enough-access role activation for Azure resources, while Azure Arc extends Azure Policy governance to on-premises servers for consistent security policies. Azure Firewall with threat intelligence performs encrypted traffic inspection between on-premises and Azure, and Microsoft Defender for Identity monitors and audits privileged access and identity-based threats. Option A fails because Azure Bastion only provides RDP/SSH access to VMs and Azure Automation is not a policy/governance solution for on-prem servers. Option C is wrong because Microsoft Sentinel cannot enforce JIT access via playbooks, and Azure Policy alone does not provide JIT/JEA. Option D is incorrect because permanent Entra role assignments violate JIT/JEA, Azure Site Recovery is a disaster recovery service, and ExpressRoute does not inherently encrypt traffic.

Answer

Use Azure Bastion for administrative access, Azure Automation for on-prem management, Azure VPN Gateway for encrypted traffic, and Microsoft Sentinel for monitoring.

Answer

Use Microsoft Sentinel for all aspects, including JIT via playbooks, Azure Arc for management, Azure Firewall for traffic, and Azure Policy for compliance.

Answer

Use Microsoft Entra roles with permanent assignments, Azure Site Recovery for on-premises management, Azure ExpressRoute for encrypted traffic, and Microsoft Defender for Cloud for monitoring.

Question 12

You are designing a security solution for a small business that uses Azure App Services to host a web application. The business has the following requirements: - The web application must be protected against common web vulnerabilities like SQL injection and cross-site scripting (XSS). - All traffic to the application must be encrypted. - The solution should be cost-effective and require minimal management overhead. - The application must be able to scale automatically based on demand. Which Azure service should you use to meet these requirements?

Accepted Answer

Deploy Azure Application Gateway with Web Application Firewall (WAF) in front of the App Service.. Azure Application Gateway with Web Application Firewall (WAF) in front of the App Service is correct because it provides layer 7 protection against common web vulnerabilities such as SQL injection and XSS via OWASP-based WAF rules, supports end-to-end TLS encryption, and integrates natively with App Service while autoscaling with demand at low management overhead. Azure Firewall (A) is a layer 3/4 network firewall with limited application-layer inspection and does not provide the required WAF protections for web apps. Azure CDN with custom domain and HTTPS (B) only encrypts and caches content but does not inspect or block web attacks like SQL injection or XSS. Azure Front Door with WAF policies (C) can provide WAF and TLS, but it is a global CDN-focused service that is typically less cost-effective for a small business's single-region App Service compared to Application Gateway WAF.

Answer

Use Azure Firewall to inspect traffic to the App Service.

Answer

Use Azure CDN with custom domain and HTTPS.

Answer

Deploy Azure Front Door with WAF policies.

Question 13

Your organization is planning to deploy Microsoft Defender for Cloud to protect a hybrid environment that includes on-premises servers and Azure virtual machines. You need to ensure that the security recommendations and threat detections are consistently applied across all resources. What should you configure?

Accepted Answer

Enable auto-provisioning for the Log Analytics agent on all subscriptions.. Enabling auto-provisioning for the Log Analytics agent in Microsoft Defender for Cloud automatically deploys the agent to supported Azure VMs and on-premises servers connected via Azure Arc, ensuring consistent security recommendations and threat detections across the hybrid environment. Auto-provisioning is the native Defender for Cloud mechanism designed for this purpose, and it works at the subscription level to cover all resources. Option A is incomplete because connecting servers via Azure Arc alone does not install the monitoring agent or apply the security data collection needed for Defender for Cloud. Option C is not the intended Defender for Cloud configuration path, since Azure Policy alone does not enable the Defender for Cloud auto-provisioning behavior. Option D similarly relies on policy assignment rather than the built-in auto-provisioning setting that Defender for Cloud uses to deploy the agent.

Answer

Connect on-premises servers using Azure Arc and assign a built-in policy initiative.

Answer

Configure an Azure Policy to require the deployment of the Log Analytics agent.

Answer

Use Azure Policy to assign the 'Deploy Log Analytics agent' initiative to the management group.

Question 14

Your company uses Azure Firewall to secure outbound traffic from a hub virtual network that contains multiple spoke virtual networks. You need to implement a solution that allows traffic from specific spoke VMs to reach a specific external SaaS endpoint, while blocking all other outbound traffic. The SaaS endpoint uses a dynamic set of IP addresses that change frequently. What should you do?

Accepted Answer

Configure Azure Firewall application rules using FQDN tags to allow traffic to the SaaS endpoint.. Option D is correct because Azure Firewall application rules can filter outbound traffic by fully qualified domain name (FQDN), and FQDN tags let you allow well-known SaaS endpoints whose underlying IP addresses change dynamically without you having to maintain IP lists. This directly satisfies the requirement to permit only specific spoke VMs to reach the SaaS endpoint while all other outbound traffic remains blocked by the default deny. Option A is unsuitable because static IP ranges become stale as the SaaS provider rotates addresses. Option B does not fit since threat intelligence-based filtering blocks known malicious traffic rather than allowing a specific SaaS endpoint. Option C is incorrect because service tags represent Microsoft/Azure service IP ranges, not arbitrary third-party SaaS FQDNs.

Answer

Configure Azure Firewall network rules to allow traffic to the SaaS endpoint's current IP range.

Answer

Deploy Azure Firewall Manager and enable threat intelligence-based filtering.

Answer

Use Azure Firewall service tags to allow traffic to the SaaS endpoint.

Question 15

Refer to the exhibit. You are reviewing an Azure Policy definition that is assigned to a subscription containing several virtual machines. After the assignment, users report that they cannot create new VMs. What is the most likely reason?

Accepted Answer

The policy denies creation of VMs that do not use managed disks.. The correct option is B: the policy denies creation of VMs that do not use managed disks. Azure Policy definitions commonly enforce managed disks via a deny effect, so any VM deployment request specifying unmanaged (blob-based) disks is blocked at the resource provider, which explains why users cannot create new VMs after the assignment. Option A is not the most likely cause because a size-based deny would only block specific VM sizes, not all new VM creation. Option C is incorrect because denying managed disks would contradict Azure's recommended configuration and would not match a typical policy intent. Option D is too narrow, since a premium SSD requirement would only block VMs using Standard HDD/SSD disks, not all VM deployments.

Answer

The policy denies creation of VMs with a specific size.

Answer

The policy denies creation of VMs that use managed disks.

Answer

The policy denies creation of VMs that do not use premium SSDs.