SC-100 Design security solutions for infrastructure Practice Test 7 — 15 Questions

Question 1

A financial services company is designing a secure infrastructure for their Azure SQL Database. They need to encrypt data at rest using customer-managed keys (CMK) stored in a key vault with soft-delete and purge protection enabled. The encryption must be transparent to applications. What should they configure?

Accepted Answer

Transparent Data Encryption (TDE) with Azure Key Vault. Azure SQL Database supports Transparent Data Encryption (TDE) with CMK in Azure Key Vault. Always Encrypted is for column-level encryption. Dynamic Data Masking is for masking, not encryption. Azure Information Protection is for classification.

Answer

Azure Information Protection

Answer

Dynamic Data Masking

Answer

Always Encrypted

Question 2

A company uses Microsoft Defender for Cloud to assess the security posture of their Azure subscriptions. They want to receive alerts when a resource is deployed without encryption enabled. What should they configure?

Accepted Answer

Azure Policy definition to audit or deny resources without encryption. Azure Policy with a custom policy definition can audit or deny resources without encryption. Defender for Cloud's regulatory compliance dashboard shows compliance status. Security alerts are for threats, not configuration drift. Azure Blueprints are for packaging resources.

Answer

Azure Blueprints

Answer

Microsoft Defender for Cloud regulatory compliance dashboard

Answer

Microsoft Defender for Cloud security alerts

Question 3

Which TWO actions should you take to secure Azure SQL Database against SQL injection attacks?

Accepted Answer

Enable Azure Web Application Firewall (WAF) on Application Gateway. Using parameterized queries in stored procedures prevents SQL injection by separating SQL code from data. Enabling Azure WAF on Application Gateway filters malicious requests at the network edge. Row-Level Security is for access control, not injection. Always Encrypted protects data at rest. Dynamic Data Masking obfuscates data.

Answer

Implement Always Encrypted

Answer

Enable Row-Level Security (RLS)

Answer

Apply Dynamic Data Masking

Question 4

Which THREE components are required to implement a zero-trust network architecture in Azure using Microsoft security solutions?

Accepted Answer

Microsoft Defender for Cloud Apps. Azure AD Conditional Access enforces access policies. Microsoft Defender for Cloud Apps provides cloud access security broker (CASB) functionality. Azure Policy ensures compliance. Azure Bastion is for secure connectivity. Microsoft Sentinel is for SIEM, not a core zero-trust component.

Answer

Microsoft Sentinel

Answer

Azure Bastion

Question 5

Which TWO Azure services can be used to protect a virtual network from inbound DDoS attacks at the network layer?

Accepted Answer

Azure DDoS Protection Standard. Azure DDoS Protection Standard provides defense against volumetric DDoS attacks. Azure Firewall can filter traffic at the network layer, but its DDoS capabilities are limited; Azure DDoS Protection is the primary service. WAF is for application layer. NSGs can filter traffic but not mitigate DDoS. Traffic Manager is for load balancing.

Answer

Azure Web Application Firewall (WAF)

Answer

Azure Traffic Manager

Answer

Network Security Groups (NSGs)

Question 6

Refer to the exhibit. An administrator is reviewing a just-in-time (JIT) access request in Microsoft Entra Privileged Identity Management (PIM) for Azure resources. The request was approved. What does the roleDefinitionId 'b24988ac-6180-42a0-ab88-20f7382dd24c' correspond to?

Accepted Answer

Storage Account Contributor. The roleDefinitionId 'b24988ac-6180-42a0-ab88-20f7382dd24c' is the GUID for the 'Storage Account Contributor' role in Azure RBAC. This is a built-in role that allows management of storage accounts, including access to storage account keys. The request is for temporary access to a storage account, and the role provides the necessary permissions.

Answer

Storage Blob Data Contributor

Answer

Contributor

Answer

Reader

Question 7

Refer to the exhibit. A security analyst runs the following KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

Detect brute-force attacks against Windows servers. The query filters Windows Security Events for failed logon attempts (EventID 4625) in the last hour, groups by user account, computer, and IP address, and then shows only those with more than 10 failures. This is used to detect brute-force attacks.

Answer

List all accounts that have been locked out

Answer

Identify successful logins from multiple IP addresses

Answer

Find users who logged in after hours

Question 8

Refer to the exhibit. An administrator is deploying an Azure Firewall using the ARM template snippet. After deployment, traffic from the 10.0.0.0/16 subnet to www.microsoft.com on HTTPS is allowed. What is a potential security issue with this configuration?

Accepted Answer

Allowing HTTP (port 80) to *.microsoft.com is unnecessary and could be exploited. The rule allows HTTP (port 80) to *.microsoft.com, which is unnecessary and could allow unencrypted traffic. HTTPS (port 443) is sufficient. Allowing HTTP could expose traffic to interception. Additionally, the rule allows all *.microsoft.com subdomains, which might be overly permissive, but the main issue is the inclusion of HTTP.

Answer

The priority of 100 is too high and could override other rules

Answer

The firewall SKU tier should be Premium for better security

Answer

The source address range is too broad

Question 9

Your organization uses Microsoft Defender for Cloud to secure a hybrid environment. You need to ensure that virtual machines running on-premises are assessed for security misconfigurations. What should you deploy?

Accepted Answer

Azure Arc on the on-premises servers. Azure Arc enables Azure management services, including Defender for Cloud, to be extended to on-premises servers. Option A is correct because Arc-connected machines can be onboarded to Defender for Cloud for assessment. Option B is incorrect because Azure Policy alone does not perform assessments. Option C is incorrect because Log Analytics agent without Arc does not integrate with Defender for Cloud assessments. Option D is incorrect because just enabling Defender for Cloud does not cover on-premises VMs without Arc.

Answer

Log Analytics agent on the on-premises servers

Answer

Microsoft Defender for Cloud's Vulnerability Assessment solution

Answer

Azure Policy guest configuration

Question 10

Your company plans to use Microsoft Sentinel to manage security incidents. You need to design a solution that reduces alert fatigue by grouping related alerts into incidents. Which feature should you enable?

Accepted Answer

Analytics rule with alert grouping enabled. Sentinel's analytics rules use alert grouping to combine related alerts into a single incident. Option A is correct. Option B is incorrect because automation rules trigger actions but don't group alerts. Option C is incorrect because watchlists are for reference data. Option D is incorrect because playbooks automate responses, not grouping.

Answer

Watchlists to filter noisy alerts

Answer

Automation rules that trigger on alert creation

Answer

Playbooks that run on alert creation

Question 11

Your organization has a Microsoft Defender for Cloud Apps policy that detects suspicious OAuth app permissions. You need to ensure that when a high-risk app is detected, the app is automatically disabled and the user is notified. What is the most efficient design?

Accepted Answer

Use the 'Disable app' governance action in the policy, and configure email notification. Option B is correct because it uses the built-in governance action in Defender for Cloud Apps to disable the app and send email. Option A is incomplete as notification alone doesn't disable. Option C is less efficient because it requires additional automation. Option D is incorrect because Incident does not automatically disable the app.

Answer

Configure the policy to notify the user via email

Answer

Send the alert to Microsoft Sentinel and create an incident with a playbook

Answer

Create a Power Automate flow that triggers on the alert to disable the app

Question 12

You are designing a secure remote access solution for on-premises web applications using Microsoft Entra ID. The solution must support multifactor authentication (MFA) and conditional access. Which service should you use?

Accepted Answer

Microsoft Entra application proxy. Microsoft Entra Application Proxy provides secure remote access to on-premises web apps with MFA and Conditional Access. Option A is correct. Option B is incorrect because VPN does not integrate with Entra ID MFA. Option C is incorrect because Azure AD (Entra ID) alone doesn't provide proxying. Option D is incorrect because DirectAccess is Windows-only and doesn't support MFA natively.

Answer

Windows Server DirectAccess

Answer

VPN gateway with RADIUS authentication

Answer

Microsoft Entra ID (Azure AD)

Question 13

Your company uses Microsoft Intune to manage devices. You need to ensure that corporate data is wiped from a device if it reports a jailbroken status. What is the best approach?

Accepted Answer

Create a device compliance policy that marks jailbroken devices as noncompliant, then use Conditional Access to require compliance. Option C is correct because a compliance policy can mark the device as noncompliant if jailbroken, and a conditional access policy can then trigger a wipe. Option A is too broad. Option B is incorrect because remote wipe is manual. Option D is incorrect because app protection policies target app data, not device.

Answer

Use the remote wipe action from Intune when a jailbreak is reported

Answer

Deploy an app protection policy that wipes data if jailbreak is detected

Answer

Configure a device configuration policy to block jailbroken devices

Question 14

You are designing a privileged access solution for your Azure infrastructure. You need to ensure that just-in-time (JIT) access is required for all administrative actions on Azure VMs. What should you configure?

Accepted Answer

Just-in-time VM access in Microsoft Defender for Cloud. Option B is correct because Microsoft Defender for Cloud's JIT VM access provides time-bound access to VMs. Option A is incorrect because PIM is for role-based access, not VM access. Option C is incorrect because Azure Bastion provides secure RDP/SSH but not JIT. Option D is incorrect because NSGs alone do not enforce JIT.

Answer

Microsoft Entra Privileged Identity Management (PIM) for Azure VM roles

Answer

Network security groups with service tags

Answer

Azure Bastion with Conditional Access

Question 15

Your organization uses Microsoft Purview to classify sensitive data in Azure storage. You need to ensure that a file containing PII is automatically protected when uploaded to an Azure Blob Storage account. What should you use?

Accepted Answer

Microsoft Purview Data Policy with auto-labeling. Option A is correct because Purview Data Policy can enforce auto-labeling and protection based on classification. Option B is incorrect because sensitivity labels alone do not trigger protection automatically. Option C is incorrect because Azure Information Protection is now part of Purview. Option D is incorrect because retention labels are for retention, not protection.

Answer

Microsoft Purview retention labels

Answer

Microsoft Purview Information Protection sensitivity labels manually applied

Answer

Azure Information Protection unified labeling client