SC-100 Design security solutions for infrastructure Practice Test 7 — 15 Questions

Question 1

Refer to the exhibit. An administrator is reviewing a just-in-time (JIT) access request in Microsoft Entra Privileged Identity Management (PIM) for Azure resources. The request was approved. What does the roleDefinitionId 'b24988ac-6180-42a0-ab88-20f7382dd24c' correspond to?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Storage Account Contributor. The roleDefinitionId 'b24988ac-6180-42a0-ab88-20f7382dd24c' is the GUID for the 'Storage Account Contributor' role in Azure RBAC. This is a built-in role that allows management of storage accounts, including access to storage account keys. The request is for temporary access to a storage account, and the role provides the necessary permissions.

Answer

Storage Blob Data Contributor

Answer

Contributor

Answer

Reader

Question 2

Refer to the exhibit. A security analyst runs the following KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

Detect brute-force attacks against Windows servers. The query filters Windows Security Events for failed logon attempts (EventID 4625) in the last hour, groups by user account, computer, and IP address, and then shows only those with more than 10 failures. This is used to detect brute-force attacks.

Answer

List all accounts that have been locked out

Answer

Identify successful logins from multiple IP addresses

Answer

Find users who logged in after hours

Question 3

Refer to the exhibit. An administrator is reviewing a just-in-time (JIT) access request in Microsoft Entra Privileged Identity Management (PIM) for Azure resources. The request was approved. What does the roleDefinitionId 'b24988ac-6180-42a0-ab88-20f7382dd24c' correspond to?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Allowing HTTP (port 80) to *.microsoft.com is unnecessary and could be exploited. The rule allows HTTP (port 80) to *.microsoft.com, which is unnecessary and could allow unencrypted traffic. HTTPS (port 443) is sufficient. Allowing HTTP could expose traffic to interception. Additionally, the rule allows all *.microsoft.com subdomains, which might be overly permissive, but the main issue is the inclusion of HTTP.

Answer

The priority of 100 is too high and could override other rules

Answer

The firewall SKU tier should be Premium for better security

Answer

The source address range is too broad

Question 4

Your organization uses Microsoft Defender for Cloud to secure a hybrid environment. You need to ensure that virtual machines running on-premises are assessed for security misconfigurations. What should you deploy?

Accepted Answer

Azure Arc on the on-premises servers. Azure Arc is required to extend Azure management and security services, such as Microsoft Defender for Cloud, to on-premises servers. By deploying Azure Arc on on-premises servers, you can onboard them to Defender for Cloud, enabling assessment of security misconfigurations. Log Analytics agent alone (option A) does not provide the necessary integration with Defender for Cloud without Arc. Microsoft Defender for Cloud's Vulnerability Assessment solution (option B) is a capability within Defender for Cloud, not a deployment to enable assessment. Azure Policy guest configuration (option D) is used for in-guest policy compliance, not for onboarding on-premises servers to Defender for Cloud for security misconfiguration assessment.

Answer

Log Analytics agent on the on-premises servers

Answer

Microsoft Defender for Cloud's Vulnerability Assessment solution

Answer

Azure Policy guest configuration

Question 5

Your company plans to use Microsoft Sentinel to manage security incidents. You need to design a solution that reduces alert fatigue by grouping related alerts into incidents. Which feature should you enable?

Accepted Answer

Analytics rule with alert grouping enabled. Sentinel's analytics rules use alert grouping to combine related alerts into a single incident. Option A is correct. Option B is incorrect because watchlists are for reference data, not for grouping alerts. Option C is incorrect because automation rules trigger actions but don't group alerts. Option D is incorrect because playbooks automate responses, not grouping.

Answer

Watchlists to filter noisy alerts

Answer

Automation rules that trigger on alert creation

Answer

Playbooks that run on alert creation

Question 6

Your organization has a Microsoft Defender for Cloud Apps policy that detects suspicious OAuth app permissions. You need to ensure that when a high-risk app is detected, the app is automatically disabled and the user is notified. What is the most efficient design?

Accepted Answer

Use the 'Disable app' governance action in the policy, and configure email notification. The most efficient because it uses the built-in 'Disable app' governance action in Defender for Cloud Apps, which automatically disables the high-risk OAuth app and sends an email notification to the user. This is a single policy configuration with no external dependencies. Option B only notifies the user without disabling the app, so it does not fully address the requirement. Option C involves sending alerts to Sentinel and using a playbook, which adds complexity and is less efficient. Option D requires a Power Automate flow, which is also less efficient than the native policy action.

Answer

Configure the policy to notify the user via email

Answer

Send the alert to Microsoft Sentinel and create an incident with a playbook

Answer

Create a Power Automate flow that triggers on the alert to disable the app

Question 7

You are designing a secure remote access solution for on-premises web applications using Microsoft Entra ID. The solution must support multifactor authentication (MFA) and conditional access. Which service should you use?

Accepted Answer

Microsoft Entra application proxy. Microsoft Entra Application Proxy provides secure remote access to on-premises web apps with MFA and Conditional Access. Option A is correct. Option B (Windows Server DirectAccess) is incorrect because DirectAccess uses IPsec and does not natively integrate with Entra ID MFA and Conditional Access. Option C (VPN gateway with RADIUS authentication) is incorrect because while it can support MFA via RADIUS, it does not provide the same level of integration with Entra ID Conditional Access policies and is not a reverse proxy solution. Option D (Microsoft Entra ID) is incorrect because Entra ID alone is an identity service, not a remote access proxy; it requires a component like Application Proxy to broker access to on-premises apps.

Answer

Windows Server DirectAccess

Answer

VPN gateway with RADIUS authentication

Answer

Microsoft Entra ID (Azure AD)

Question 8

Your company uses Microsoft Intune to manage devices. You need to ensure that corporate data is wiped from a device if it reports a jailbroken status. What is the best approach?

Accepted Answer

Create a device compliance policy that marks jailbroken devices as noncompliant, then use Conditional Access to require compliance. A device compliance policy can mark jailbroken devices as noncompliant, and Conditional Access can then enforce a wipe or block access, ensuring automatic remediation. Option B is incorrect because remote wipe is a manual action and does not automatically respond to compliance status. Option C is incorrect because app protection policies target app data, not the entire device. Option D is incorrect because device configuration policies do not trigger conditional access or automatic wipe.

Answer

Use the remote wipe action from Intune when a jailbreak is reported

Answer

Deploy an app protection policy that wipes data if jailbreak is detected

Answer

Configure a device configuration policy to block jailbroken devices

Question 9

You are designing a privileged access solution for your Azure infrastructure. You need to ensure that just-in-time (JIT) access is required for all administrative actions on Azure VMs. What should you configure?

Accepted Answer

Just-in-time VM access in Microsoft Defender for Cloud. Microsoft Defender for Cloud's JIT VM access provides time-bound access to VMs. Option A is incorrect because PIM is for role-based access, not VM access. Option C is incorrect because network security groups with service tags can filter traffic but do not enforce just-in-time access. Option D is incorrect because Azure Bastion with Conditional Access provides secure RDP/SSH with conditional access policies, but does not enforce just-in-time access.

Answer

Microsoft Entra Privileged Identity Management (PIM) for Azure VM roles

Answer

Network security groups with service tags

Answer

Azure Bastion with Conditional Access

Question 10

Your organization uses Microsoft Purview to classify sensitive data in Azure storage. You need to ensure that a file containing PII is automatically protected when uploaded to an Azure Blob Storage account. What should you use?

Accepted Answer

Microsoft Purview Information Protection auto-labeling policy. Microsoft Purview Information Protection auto-labeling policies automatically apply sensitivity labels based on classification results. When a file containing PII is uploaded to Azure Blob Storage, an auto-labeling policy can apply a sensitivity label that enforces protection (e.g., encryption). Option C is the correct feature for automatic labeling.

Answer

Microsoft Purview retention labels

Answer

Microsoft Purview Information Protection sensitivity labels manually applied

Answer

Azure Information Protection unified labeling client

Question 11

Your company plans to use Microsoft Sentinel to detect threats across multiple Azure subscriptions. You need to design a cost-effective solution that ingests logs from all subscriptions. What should you use?

Accepted Answer

Deploy a single Sentinel workspace and configure data collection rules to collect logs from all subscriptions. Deploying a single Microsoft Sentinel workspace and using data collection rules to ingest logs from all subscriptions centralizes log management and minimizes costs by avoiding redundant storage and processing. Option A is incorrect because Azure Lighthouse enables cross-subscription management but does not handle log ingestion itself. Option C is incorrect because multiple workspaces would increase costs and complexity without benefit. Option D is incorrect because Azure Policy can assign a Log Analytics workspace but does not centrally ingest logs from multiple subscriptions into a single Sentinel workspace.

Answer

Use Azure Lighthouse to manage cross-subscription connectivity

Answer

Create a separate Sentinel workspace for each subscription

Answer

Use Azure Policy to assign a Log Analytics workspace to each subscription

Question 12

Refer to the exhibit. You are reviewing an Azure Policy definition in JSON. What does this policy do?

Accepted Answer

Denies SQL servers from using Azure AD authentication. The policy checks if the SQL server's 'administratorType' is 'ActiveDirectory' and applies the 'deny' effect when true. This means that if Azure AD authentication is configured, the policy denies the request, effectively blocking the use of Azure AD authentication for SQL servers. Therefore, answer A is correct. Option B is incorrect because the policy denies, not allows. Option C is incorrect because the condition examines the administrator type, not firewall rules. Option D is incorrect because the policy denies when an Azure AD admin is set, rather than enforcing its presence.

Answer

Allows SQL servers to use Azure AD authentication

Answer

Denies SQL servers that do not have a firewall rule

Answer

Enforces that all SQL servers must have an Azure AD admin

Question 13

Refer to the exhibit. You run the PowerShell cmdlet and see that EnabledForDiskEncryption is false. You need to ensure that this key vault can be used for Azure Disk Encryption. What should you do?

Accepted Answer

Run Set-AzKeyVaultAccessPolicy with the -EnabledForDiskEncryption parameter. Azure Disk Encryption requires the key vault to have the EnabledForDiskEncryption property set to true. This property can be enabled on an existing key vault using the Set-AzKeyVaultAccessPolicy cmdlet with the -EnabledForDiskEncryption parameter. Option A is incorrect because re-creating the key vault is unnecessary and would not use the -EnabledForDiskEncryption parameter on New-AzKeyVault. Option B is correct as it uses the appropriate parameter on an existing vault. Option C is incorrect because -EnabledForDeployment enables access for Azure Virtual Machines, not disk encryption. Option D is incorrect because -EnabledForTemplateDeployment enables access for Azure Resource Manager template deployments, not disk encryption.

Answer

Re-create the key vault with -EnabledForDiskEncryption parameter

Answer

Run Set-AzKeyVaultAccessPolicy with the -EnabledForDeployment parameter

Answer

Run Set-AzKeyVaultAccessPolicy with the -EnabledForTemplateDeployment parameter

Question 14

Refer to the exhibit. You are reviewing a KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

Count security events per user, per computer, per event type in the last hour. The KQL query filters SecurityEvent for the last hour, then summarizes the count of events by Account, Computer, and EventID. This groups security events by user, computer, and event type, allowing you to count how many events of each type occurred per user per computer in the last hour. Option A is incorrect because the query does not filter for administrator accounts. Option B is incorrect because it does not filter for failed logon attempts. Option C is incorrect because it does not find the most common event IDs; it counts events per event ID per user per computer, not overall commonality. Therefore, Option D correctly describes the query's purpose.

Answer

List all administrator accounts that logged in

Answer

Identify failed logon attempts across all computers

Answer

Find the most common event IDs across all computers

Question 15

Which TWO of the following are features of Microsoft Defender for Cloud that help secure infrastructure? (Choose two.)

Accepted Answer

Secure Score. Secure Score (A) is a feature of Microsoft Defender for Cloud that aggregates security findings across your Azure subscriptions and provides a numerical score based on the implementation of security controls. It helps prioritize remediation actions by showing the potential score improvement for each recommendation, directly enabling infrastructure hardening.

Answer

Incident investigation

Answer

Privileged Identity Management

Answer

User and Entity Behavior Analytics (UEBA)