SC-100 Design security solutions for infrastructure Practice Test 7 — 15 Questions

Question 1

Your company plans to use Microsoft Defender for Cloud to protect its Azure resources. You need to enable just-in-time (JIT) VM access to reduce the attack surface. Which TWO configurations are required to implement JIT access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable JIT VM access in Microsoft Defender for Cloud.. Option A is correct because enabling just-in-time VM access in Microsoft Defender for Cloud is the foundational step that turns on the JIT capability and lets Defender manage the NSG rules that block inbound RDP (3389) and SSH (22) ports until an approved request opens them temporarily. Option D is correct because assigning an Azure Policy that requires JIT access on VMs enforces the configuration at scale, ensuring VMs are onboarded to JIT and remain compliant with the organization's security baseline. Option B is not required because Azure Bastion is an alternative secure connectivity service, not a prerequisite for Defender for Cloud JIT access. Option C is not required because JIT activity is logged automatically in Defender for Cloud and Azure Activity Log; a Log Analytics workspace is optional for centralized monitoring, not mandatory for implementation. Option E is incorrect because JIT works by denying inbound traffic by default and only allowing it temporarily after approval, so an NSG allowing all inbound traffic would defeat the purpose.

Answer

Deploy Azure Bastion for secure RDP/SSH connectivity.

Answer

Configure a Log Analytics workspace to collect JIT logs.

Answer

Create a network security group (NSG) that allows all inbound traffic.

Question 2

Your company is planning to use Azure Policy to enforce security compliance across multiple subscriptions. You need to define a set of policies that will be applied to all subscriptions. Which THREE components should you include in your policy assignment?

Accepted Answer

Parameters.. A policy assignment fundamentally requires a policy definition (B), which contains the JSON rule logic (the if/then condition and effect) that Azure Policy evaluates against resources. The assignment scope (C) is also required because it determines exactly where the assignment applies — for example, a management group spanning all subscriptions, a single subscription, or a resource group — and enforcement only occurs within that scope. Parameters (A) are included because they let you supply or override values at assignment time (such as allowed locations or tag values), making the same definition reusable across the multiple subscriptions without editing the definition itself. An initiative definition (D) is optional: it is a grouping of multiple policy definitions used when you want to assign a set as a single unit, but it is not a required component of a basic policy assignment. A remediation task (E) is likewise optional and only used to bring existing non-compliant resources into compliance for effects like deployIfNotExists or modify; it is not part of defining the assignment itself.

Answer

Initiative definition.

Answer

Remediation task.

Question 3

Your company is deploying a critical application on Azure App Service. You need to secure the application by restricting access to only users within your organization. The application should be accessible from both corporate-managed devices and personal devices that are enrolled in Microsoft Intune. You want to use Microsoft Entra ID for authentication and require that users authenticate using multi-factor authentication (MFA). What should you configure?

Accepted Answer

Configure a Conditional Access policy in Microsoft Entra ID that targets the application, requires MFA, and requires a compliant device.. Option B is correct because a Conditional Access policy in Microsoft Entra ID is the mechanism that enforces MFA and device compliance at authentication time, targeting the specific App Service application and requiring a compliant device so that both corporate-managed and Intune-enrolled personal devices are allowed. This satisfies the scenario's requirements: Entra ID authentication, MFA, and restricting access to organizational users on compliant devices. Option A is wrong because Microsoft Entra B2B collaboration is for inviting external/guest users, not for restricting access to internal organizational users. Option C is wrong because enabling App Service authentication with Entra ID only handles sign-in; it does not enforce MFA or device compliance. Option D is wrong because creating an app registration and assigning users controls access to the app but does not require MFA or a compliant device.

Answer

Use Azure AD B2B collaboration to allow only users from your organization.

Answer

Enable App Service authentication and authorization with Microsoft Entra ID as the identity provider.

Answer

Create an app registration in Microsoft Entra ID and assign users to the enterprise application.

Question 4

Your organization uses Azure SQL Database for a sensitive financial application. You need to implement a defense-in-depth strategy to protect the database. The requirements are: (1) All connections to the database must be encrypted in transit. (2) Only specific Azure services and on-premises IP ranges should be allowed to connect. (3) Database administrators should be able to view the database schema but not the actual data. (4) Auditing must be enabled for all data access. What combination of features should you implement?

Accepted Answer

Enforce TLS 1.2, configure firewall rules, enable Dynamic Data Masking, and enable auditing.. It directly satisfies all four requirements: enforcing TLS 1.2 encrypts connections in transit, firewall rules restrict access to specific Azure services and on-premises IP ranges, Dynamic Data Masking lets administrators see the schema while masking actual data values, and auditing captures all data access. The other options each miss at least one requirement: A and C do not enforce encryption in transit or mask data, and D uses Always Encrypted, which encrypts data at rest and in use but does not provide the schema-visible, data-masked behavior required for administrators.

Answer

Enable VNet service endpoints and firewall rules, and require Azure AD authentication.

Answer

Configure firewall rules, enable Azure AD authentication, and enable auditing.

Answer

Enable Always Encrypted, configure firewall rules, and enable auditing.

Question 5

Your company has a Microsoft 365 E5 subscription and uses Microsoft Defender for Office 365. You need to protect users from phishing attacks that use malicious links in email messages. The solution should allow users to report suspicious emails to the security team for analysis. You also want to automatically block repeated phishing attempts from the same sender. What should you configure?

Accepted Answer

Configure Safe Links policies and enable the Report Message add-in for user reporting.. Safe Links policies in Microsoft Defender for Office 365 provide time-of-click URL verification and detonation to protect against malicious links in email. Enabling the Report Message add-in allows users to report suspicious emails to the security team. Together, these address phishing link protection and user reporting, while Defender for Office 365 can also block repeated phishing attempts from the same sender through its anti-phishing and tenant allow/block list features.

Answer

Configure anti-spam policies and enable the Report Message add-in.

Answer

Configure Safe Attachments policies and enable the Report Message add-in.

Answer

Enable the Report Message add-in for Outlook and configure a mailbox for submissions.

Question 6

Your organization uses Microsoft Sentinel for security operations. You need to design a solution to detect and respond to lateral movement attempts using pass-the-hash attacks. Which TWO data sources should you enable in Microsoft Sentinel to best detect this activity?

Accepted Answer

Windows Security Events via Azure Monitor Agent. We need to detect pass-the-hash attacks, which involve capturing NTLM hashes to authenticate laterally. In Microsoft Sentinel, Windows Security Events via Azure Monitor Agent (Option B) log NTLM authentication events, including Event ID 4624 (successful logon) and others that can reveal pass-the-hash attempts. Microsoft Defender for Identity alerts (Option D) provide behavioral analytics and specific alerts for lateral movement, including pass-the-hash. Option A (Office 365 Audit Logs) is for cloud app activity, not on-premises lateral movement. Option C (DNS query logs) can help detect network anomalies but is not the best direct source for pass-the-hash. Option E (Azure Activity Log) logs Azure resource operations and is irrelevant for on-premises lateral movement.

Answer

Office 365 Audit Logs

Answer

DNS query logs

Answer

Azure Activity Log

Question 7

Your company is deploying Microsoft Sentinel in a government agency that requires strict data residency. You need to ensure that all Sentinel data is stored within the United States. Which THREE actions must you take to meet this requirement?

Accepted Answer

Disable cross-region replication in the Log Analytics workspace settings.. Option B is correct because Microsoft Sentinel stores all its data in the Log Analytics workspace it is attached to, so creating that workspace in a US Azure region (e.g., East US) is the foundational step to guarantee US data residency. Option A is correct because cross-region replication (a workspace-level setting that copies data to a secondary region for resiliency) could move or replicate Sentinel data outside the chosen US region, so it must be disabled to keep all data resident in the United States. Option E is correct because Azure Policy can audit (and optionally deny) Log Analytics workspaces whose region is not in the allowed US list, providing ongoing compliance enforcement that new workspaces stay in-region. Option C is not correct because exporting data to a storage account in a different region would deliberately move data out of the required US residency boundary, which is the opposite of the goal. Option D is not correct because customer-managed keys in Azure Key Vault provide encryption-at-rest key control, not data residency; CMK does not determine or constrain where Sentinel data is stored.

Answer

Configure data export to a storage account in a different region for redundancy.

Answer

Enable customer-managed keys (CMK) using Azure Key Vault in the same region.

Question 8

Your organization is migrating from on-premises Active Directory to Microsoft Entra ID. You need to design a solution for hybrid identity that supports seamless SSO for legacy applications that require Kerberos authentication. Which THREE components should you include in your design?

Accepted Answer

Deploy Azure AD Application Proxy to publish legacy apps. Option A (Microsoft Entra application proxy) is required to publish on-prem legacy applications that use Integrated Windows Authentication (IWA). It uses Kerberos constrained delegation (KCD) to provide SSO for legacy apps that require Kerberos. Option B (register as Enterprise Applications) is necessary to integrate the apps with Microsoft Entra ID and manage access. Option D (Microsoft Entra Connect with Seamless SSO enabled) provides the seamless sign-on experience by using the user's domain Kerberos ticket when authenticating to Entra ID. Option E (Password Hash Sync with SSPR integration) is not required for this scenario; Seamless SSO works with either PHS or Pass-through Authentication, and SSPR integration is unrelated to Kerberos SSO for legacy apps. Option C (AD FS) is optional and not required when using Seamless SSO and Application Proxy.

Answer

Active Directory Federation Services (AD FS) deployed on-premises

Answer

Password Hash Sync (PHS) with Self-Service Password Reset (SSPR) integration

Question 9

Your company uses Microsoft Intune to manage Windows 10 devices. You need to design a security baseline that ensures devices meet the organization's security requirements, including BitLocker encryption, Windows Defender Firewall rules, and Microsoft Defender for Endpoint settings. Which TWO Intune features should you use to apply these configurations?

Accepted Answer

Endpoint security policies for Antivirus, Firewall, and Disk Encryption. Option B is correct because Intune's Endpoint security node provides dedicated policy types for Antivirus (Microsoft Defender for Endpoint settings), Firewall (Windows Defender Firewall rules), and Disk Encryption (BitLocker), which directly map to the stated requirements. Option E is correct because Security Baselines for Windows 10 deliver Microsoft's recommended configuration settings, including BitLocker, firewall, and Defender for Endpoint protections, and can be deployed to enforce a hardened baseline. Option A is wrong because device enrollment restrictions only control which devices or platforms may enroll, not security configuration. Option C is wrong because compliance policies evaluate and report device state against conditions but do not apply the required settings. Option D is wrong because custom OMA-URI profiles are for settings not covered by built-in policies and are not the intended mechanism for these standard security configurations.

Answer

Device enrollment restrictions

Answer

Compliance policies for Windows 10

Answer

Custom configuration profiles using OMA-URI

Question 10

Your organization is adopting a Zero Trust security model. You need to design a solution for secure remote access to on-premises applications that eliminates VPNs. Which TWO Microsoft technologies should you use?

Accepted Answer

Microsoft Entra Application Proxy. Microsoft Entra Application Proxy (C) is correct because it publishes on-premises web applications to remote users through the Entra ID cloud service, using outbound-only connectors on the internal network, so users authenticate to Entra ID and reach apps without any inbound VPN or open firewall ports. Microsoft Defender for Cloud Apps (D) is correct because it provides Conditional Access App Control, session monitoring, and data protection for those published apps, which is a core component of a Zero Trust remote-access design that replaces VPN-based access with identity- and policy-based controls. Azure Bastion (A) is not correct here because it provides RDP/SSH access to Azure VMs via the Azure portal, not to on-premises applications. Microsoft Intune (B) is not correct because it is a device management and compliance service, not a remote application publishing or access technology. Azure VPN Gateway (E) is not correct because it is a VPN solution, which the scenario explicitly requires eliminating.

Answer

Azure Bastion

Answer

Microsoft Intune

Answer

Azure VPN Gateway

Question 11

Your organization uses Azure Kubernetes Service (AKS) for containerized workloads. You need to design a security solution that includes network segmentation, threat detection, and secret management. Which THREE Azure services should you include?

Accepted Answer

Azure Key Vault with CSI driver for secrets store. Azure Key Vault with CSI driver, which provides secret management for AKS pods. Option C is Azure Policy for Kubernetes, which enforces network policies and compliance via Azure Policy add-on. Option D is Microsoft Defender for Cloud, which provides threat detection for Kubernetes clusters. Option B (Azure Service Bus) is a messaging service and not relevant. Option E (Azure Firewall Premium) is a perimeter firewall, not specific to AKS.

Answer

Azure Service Bus

Answer

Azure Firewall Premium

Question 12

You are a security architect at a global manufacturing company. The company uses a hybrid infrastructure with on-premises Active Directory and Azure. They have recently deployed Microsoft Sentinel as their SIEM. The security team wants to detect and investigate ransomware attacks that spread via SMB. The CISO has requested a solution that can automatically block malicious IPs at the network level and provide forensic evidence. You need to design a solution that meets these requirements with minimal manual intervention. What should you include in your design?

Accepted Answer

Integrate Microsoft Defender for Identity with Sentinel. Create a playbook that automatically adds malicious IPs to a custom Azure Firewall policy, and use Sentinel incidents for investigation.. Option C is correct because Microsoft Defender for Identity natively monitors on-premises Active Directory traffic (including SMB-based lateral movement and ransomware behaviors like reconnaissance and credential theft) and feeds those detections into Microsoft Sentinel, while a Sentinel playbook (Logic App) can automatically push malicious IPs into an Azure Firewall policy for network-level blocking and retain Sentinel incidents as forensic evidence. This combination delivers automated containment with minimal manual intervention, matching the CISO's requirements. Option A is wrong because it relies on manual IP blocking and Azure Firewall threat intelligence filtering does not detect SMB ransomware behavior in on-premises AD. Option B is wrong because Defender for Cloud focuses on cloud workload posture/protection, not on-premises AD SMB attack detection, and a third-party firewall in a VPC is not the Azure-native automated path. Option D is wrong because NSGs operate at L3/L4 without SMB anomaly detection, and applying NSG rules via Azure Policy is not an automated incident-response blocking mechanism.

Answer

Deploy Azure Firewall with threat intelligence-based filtering enabled. Use Sentinel to generate alerts when SMB traffic is detected, and manually block IPs.

Answer

Use Microsoft Defender for Cloud to detect ransomware and deploy a third-party firewall in VPC. Configure Sentinel to send alerts to the firewall API.

Answer

Enable network security groups (NSGs) on all subnets. Use Sentinel to detect SMB anomalies and apply NSG rules via Azure Policy.

Question 13

You are designing a security solution for a financial services company that uses Microsoft 365 E5 and Azure. They have 10,000 users and 500 servers. They need to implement a Zero Trust network strategy that includes microsegmentation, identity-based access, and continuous monitoring. The solution must work across on-premises and cloud workloads. They also require that all access to critical servers is logged and audited. What should you include in your design?

Accepted Answer

Use Azure Virtual Network Manager (AVNM) for network groups and security admin rules. Implement Microsoft Entra ID Conditional Access with device compliance. Use Microsoft Defender for Cloud for continuous monitoring and Azure Policy for audit.. Azure Virtual Network Manager (AVNM) provides network groups and security admin rules for microsegmentation across on-premises and cloud workloads. Microsoft Entra ID Conditional Access with device compliance enables identity-based access. Microsoft Defender for Cloud offers continuous monitoring, and Azure Policy with audit logging ensures all access to critical servers is logged and audited. Option A is incorrect because Azure Firewall Premium provides perimeter security, not microsegmentation. Option B is incorrect because site-to-site VPN and a single VNet with NSGs do not provide microsegmentation and rely on a perimeter model, not Zero Trust. Option D is incorrect because it uses a third-party SDN in AWS, which is not suitable for a Microsoft-centric environment.

Answer

Deploy Azure Firewall Premium to segment the network. Use Microsoft Entra ID for identity. Use Azure Monitor for logging.

Answer

Use site-to-site VPN to connect all on-premises servers to Azure. Place all servers in a single VNet. Use NSGs for segmentation and Azure AD for identity.

Answer

Deploy a third-party SDN solution in AWS for microsegmentation. Use Microsoft Entra ID for identity. Use CloudWatch for logging.

Question 14

Your organization uses Microsoft Intune to manage iOS and Android devices. You need to ensure that corporate data on these devices is protected in case the device is lost or stolen. The security policy requires that corporate data be automatically removed from the device when it is reported lost, while personal data remains intact. The devices are enrolled in Intune with user affinity. What should you configure?

Accepted Answer

Configure a selective wipe (retire) action that can be triggered via a Power Automate flow when a device is reported lost through a custom app.. A selective wipe (retire) in Intune removes only corporate data, management profiles, and managed apps while leaving personal data intact, which matches the requirement that corporate data be automatically removed when a device is reported lost. Triggering it through a Power Automate flow tied to a custom lost-device app provides the automated removal the scenario demands. Option B does not remove data; a compliance policy only marks the device non-compliant and can at most block access via conditional access. Option C is a full device wipe, which erases all data including personal data, so it violates the requirement. Option D only gates access to corporate resources and does not remove corporate data from the device.

Answer

Create a compliance policy that marks the device as non-compliant after 30 days of inactivity.

Answer

Configure a device wipe action in Intune that can be triggered manually from the console.

Answer

Enable conditional access to require the device to be compliant before accessing data.

Question 15

Your company is designing a secure DevOps pipeline using Azure DevOps. You need to ensure that secrets (e.g., API keys) are stored securely and scanned for leaks in code repositories. The solution must integrate with Azure Policy to prevent deployment if secrets are exposed. You also need to enforce that only approved branches can deploy to production. What should you implement?

Accepted Answer

Store secrets in Azure Key Vault with a service connection. Use GitHub Advanced Security (secret scanning) integrated with Azure DevOps. Use branch policies to require pull requests for production.. Storing secrets in a file in a private Git repo is insecure; secrets should be stored in a secure vault like Azure Key Vault. Option B is incorrect because variable groups can store secrets but they are not automatically scanned for leaks, and Azure Policy cannot directly block deployments based on secrets in code. Option C is correct: Azure Key Vault securely stores secrets, GitHub Advanced Security (when integrated with Azure DevOps) provides secret scanning to detect leaked secrets, and branch policies enforce that only approved branches (via pull requests) can deploy to production. Option D is incorrect because Microsoft Defender for Cloud scans for security vulnerabilities and misconfigurations, but it does not specifically scan for secrets in code repositories; branch policies are a valid control but the scanning element is wrong.

Answer

Store secrets in a file in a private Git repo. Use a custom script to scan for secrets. Use Azure Policy to enforce branch policy.

Answer

Use variable groups in Azure DevOps to store secrets. Use Azure Policy to block deployments if secrets are in code. Use release gates.

Answer

Use Azure Key Vault with managed identities. Use Defender for Cloud to scan for secrets in repos. Use branch policies.