SC-100 Design security solutions for infrastructure Practice Test 6 — 15 Questions

Question 1

You are designing a security solution for Azure API Management. The requirements include: protecting APIs from abuse, throttling requests, and validating JSON payloads. Which combination of features should you use?

Accepted Answer

Rate limiting policies, validate-json policy, and OAuth 2.0. Option D is correct: rate limiting throttles requests, policies validate JSON, and OAuth 2.0 secures access. Option A is wrong because Azure Firewall does not integrate with API Management for payload validation. Option B is wrong because WAF protects at the network edge, not per-API. Option C is wrong because Managed Identity is for authentication, not throttling or validation.

Answer

Managed Identities and Azure AD authentication

Answer

Azure Web Application Firewall (WAF) on Application Gateway

Answer

Azure Firewall and Network Security Groups

Question 2

Your organization is migrating on-premises Active Directory to Microsoft Entra ID. You need to ensure that users can authenticate to on-premises resources using their Entra ID credentials. Which feature should you implement?

Accepted Answer

Password Hash Sync with Microsoft Entra Connect. Option A is correct because Microsoft Entra ID with Password Hash Sync allows users to use the same password for cloud and on-premises resources. Option B is wrong because Pass-through Authentication does not sync passwords. Option C is wrong because Federation requires an on-premises identity provider. Option D is wrong because Microsoft Entra Connect Health monitors synchronization health.

Answer

Active Directory Federation Services (AD FS)

Answer

Microsoft Entra Connect Health

Answer

Pass-through Authentication

Question 3

You need to design a solution to protect Azure VMs from malware and provide security recommendations. Which Azure service should you enable?

Accepted Answer

Microsoft Defender for Cloud. Option C is correct because Microsoft Defender for Cloud provides antimalware and security recommendations. Option A is wrong because Azure Sentinel is a SIEM. Option B is wrong because Azure Monitor collects logs. Option D is wrong because Microsoft Intune manages endpoints.

Answer

Azure Sentinel

Answer

Microsoft Intune

Answer

Azure Monitor

Question 4

You are designing a secure access solution for an Azure App Service web application that authenticates users via Microsoft Entra ID. The requirements include: only allowing users from a specific Entra ID tenant, and blocking access from certain countries. Which two features should you combine? (Choose two.)

Accepted Answer

App Service authentication with Microsoft Entra ID. Options A and D are correct: App Service authentication restricts to a specific tenant, and geo-filtering on Azure Front Door blocks countries. Option B is wrong because NSGs filter network traffic, not user authentication. Option C is wrong because Conditional Access can apply policies but not geo-blocking at the network edge. Option E is wrong because Managed Identity is for app-to-Azure authentication, not user access.

Answer

Network Security Groups (NSGs)

Answer

Microsoft Entra Conditional Access

Answer

Managed Identity

Question 5

Your company uses Azure Backup to protect VMs. You need to ensure that backup data is encrypted at rest and during transit. Which features should you enable? (Choose three.)

Accepted Answer

Azure Backup using Storage Service Encryption (SSE) or customer-managed keys. Options A, C, and D are correct: Azure Backup encrypts data at rest using SSE or customer-managed keys, encrypts in transit using HTTPS, and soft delete prevents accidental deletion. Option B is wrong because Azure Disk Encryption encrypts OS/data disks but is not required for backup encryption. Option E is wrong because Azure Information Protection is for labeling, not backup encryption.

Answer

Azure Disk Encryption (BitLocker/DM-Crypt)

Answer

Azure Information Protection

Question 6

Refer to the exhibit. You are reviewing an Azure Policy definition. What is the effect of this policy?

Accepted Answer

Denies creation of Windows VMs without automatic updates enabled. Option B is correct: The policy denies the creation of virtual machines that do not have automatic updates enabled on Windows. Option A is wrong because the policy applies to all VMs, not just Linux. Option C is wrong because the effect is deny, not audit. Option D is wrong because the condition checks for the absence of the property, not its value being false.

Answer

Denies creation of Windows VMs that have automatic updates enabled

Answer

Audits Windows VMs that have automatic updates disabled

Answer

Audits Linux VMs that have automatic updates enabled

Question 7

Refer to the exhibit. You review a PowerShell script that configures an NSG rule. What is the likely security issue with this rule?

Accepted Answer

The destination address prefix is 'VirtualNetwork' which allows traffic to all VMs. Option D is correct: The rule allows HTTP (port 80) from the Internet to the VirtualNetwork address prefix, which effectively allows inbound traffic from any public IP to all VMs in the virtual network on port 80. This is overly permissive. Option A is wrong because the rule allows HTTP, not HTTPS. Option B is wrong because the rule allows inbound, not outbound. Option C is wrong because the rule allows Internet, not a specific IP.

Answer

The source address prefix should be a specific IP range

Answer

The rule allows HTTPS instead of HTTP

Answer

The rule is outbound but should be inbound

Question 8

Refer to the exhibit. A KQL query in Microsoft Sentinel is used to detect potential brute-force attacks. What does this query detect?

Accepted Answer

Successful remote logon attempts from a single IP exceeding 10. Option B is correct: The query filters for successful logon events (4624) with LogonType 10 (remote interactive), then summarizes by account and IP address, and filters for more than 10 attempts. This detects potential brute-force attacks. Option A is wrong because it looks for successful logons, not failures. Option C is wrong because it looks for remote logons (type 10). Option D is wrong because it looks for successful logons, not failures.

Answer

Local logon attempts from multiple accounts

Answer

Failed logon attempts from multiple IPs

Answer

Failed logon attempts from a single IP

Question 9

A company is designing a security solution for their hybrid infrastructure that includes on-premises servers and Azure virtual machines. They need to ensure that all administrative access to servers is just-in-time (JIT) and just-enough-administration (JEA). Which Azure service should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides JIT VM access and JEA capabilities through Azure Arc for on-premises servers, making it the correct choice. Azure AD Privileged Identity Management (PIM) is for user roles, not server access. Azure Bastion provides secure RDP/SSH access but not JIT. Azure Policy is for compliance, not JIT access.

Answer

Azure Bastion

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Azure Policy

Question 10

A global enterprise uses Azure Firewall and Azure Virtual Network Manager (AVNM) to manage network security. They want to deploy a new spoke virtual network that must be isolated from all other spokes except one specific shared services hub. The hub uses Azure Firewall to inspect traffic. What is the most secure and scalable way to enforce this isolation?

Accepted Answer

Use AVNM to create a network group for the new spoke and apply security admin rules to block inter-spoke traffic except to the hub.. Using AVNM connectivity and security admin rules allows central management of network groups and firewall policies, ensuring isolation while scaling. Direct peering with route tables is less scalable and lacks central management. NSG on the subnet is not scalable and can be overridden. Enforcing via Azure Policy with deny is possible but less integrated for network topology.

Answer

Apply a custom Azure Policy definition that denies VNet peering between the new spoke and any VNet other than the hub.

Answer

Configure direct VNet peering between the new spoke and the hub, and use route tables to block traffic to other spokes.

Answer

Deploy a network virtual appliance (NVA) in the new spoke and route all traffic through it.

Question 11

A company plans to migrate their on-premises Active Directory to Microsoft Entra ID. They need to ensure that legacy applications using NTLM authentication continue to work during the transition. What should they configure?

Accepted Answer

Microsoft Entra Connect with PTA and enable NTLM support for on-premises applications. Microsoft Entra Connect syncs identities and can be configured to allow NTLM authentication for hybrid identities. PTA or ADFS are for authentication, but not specifically for NTLM support. PHS alone doesn't handle NTLM. Cloud Kerberos trust is for Kerberos, not NTLM.

Answer

Microsoft Entra Connect with password hash synchronization (PHS) and seamless single sign-on (SSO)

Answer

Microsoft Entra Connect with Active Directory Federation Services (AD FS)

Answer

Microsoft Entra Connect with pass-through authentication (PTA)

Question 12

An organization uses Microsoft Sentinel to monitor their hybrid infrastructure. They need to detect brute-force attacks against their on-premises Windows servers. Which data source should they connect to Sentinel?

Accepted Answer

Windows Security Events via Azure Monitor Agent. Windows Security Events from Event ID 4625 (failed logon) are the primary source for detecting brute-force attacks. Azure Activity Log is for resource management events. DNS events are for DNS queries. Sysmon is for process activity, not logon failures.

Answer

Azure Activity Log

Answer

DNS Events

Answer

Sysmon Events

Question 13

A multinational corporation is designing a secure infrastructure for their Azure Kubernetes Service (AKS) clusters. They require network policies to restrict pod-to-pod communication based on namespaces and label selectors. They also need to integrate with Azure Policy for compliance. Which network policy engine should they use?

Accepted Answer

Calico through Azure Policy add-on. Azure Policy for AKS supports the Calico network policy engine for advanced network policies. Cilium is not natively integrated with Azure Policy. Azure Firewall is for cluster ingress/egress, not pod-level policies. kubenet is a basic networking plugin that does not support network policies.

Answer

kubenet

Answer

Cilium

Answer

Azure Firewall

Question 14

A small business uses Microsoft 365 Business Premium and wants to secure their Windows 10 devices with Microsoft Intune. They need to ensure that only devices compliant with the company's security policies can access corporate email. What should they configure?

Accepted Answer

Conditional Access policy requiring compliant device. Conditional Access in Microsoft Entra ID can require device compliance before granting access to Exchange Online. Device compliance policies in Intune define the security requirements. Azure AD Application Proxy is for on-prem apps. Microsoft Defender for Cloud Apps is for cloud app security. Windows Defender Firewall is for network security.

Answer

Azure AD Application Proxy

Answer

Windows Defender Firewall rules

Answer

Microsoft Defender for Cloud Apps session policy

Question 15

A company uses Azure Front Door to publish a web application globally. They need to protect against DDoS attacks and web application attacks (SQL injection, XSS). Which two services should they enable in combination?

Accepted Answer

Azure DDoS Protection Standard and Azure WAF policy on Front Door. Azure DDoS Protection protects against volumetric DDoS attacks. Azure Web Application Firewall (WAF) in Front Door protects against application-layer attacks. Azure Firewall is for network-layer filtering. Network Security Groups (NSGs) are for subnet-level filtering. Azure DDoS Protection Standard is the correct tier.

Answer

Azure DDoS Protection Standard and Azure Firewall

Answer

Azure WAF on Application Gateway and Network Security Groups

Answer

Azure Firewall and Azure DDoS Protection Basic