SC-100 Design security solutions for infrastructure Practice Test 8 — 15 Questions

Question 1

Your company plans to use Microsoft Sentinel to detect threats across multiple Azure subscriptions. You need to design a cost-effective solution that ingests logs from all subscriptions. What should you use?

Accepted Answer

Deploy a single Sentinel workspace and configure data collection rules to collect logs from all subscriptions. Option C is correct because a workspace-centric design with data collection rules sends logs from multiple subscriptions to a single workspace, reducing costs. Option A is incorrect because multiple workspaces increase cost. Option B is incorrect because Azure Policy does not centralize ingestion. Option D is incorrect because a hub-spoke network does not solve log ingestion.

Answer

Use Azure Lighthouse to manage cross-subscription connectivity

Answer

Create a separate Sentinel workspace for each subscription

Answer

Use Azure Policy to assign a Log Analytics workspace to each subscription

Question 2

Refer to the exhibit. You are reviewing an Azure Policy definition in JSON. What does this policy do?

Accepted Answer

Denies SQL servers from using Azure AD authentication. The policy checks if the SQL server administrator type is 'ActiveDirectory' and denies (deny) if true. This means it blocks the use of Azure AD authentication for SQL servers. Option B is correct. Option A is incorrect because it denies, not allows. Option C is incorrect because it checks the administrator type, not firewall. Option D is incorrect because it does not enforce AD admin; it denies if AD admin is set.

Answer

Allows SQL servers to use Azure AD authentication

Answer

Denies SQL servers that do not have a firewall rule

Answer

Enforces that all SQL servers must have an Azure AD admin

Question 3

Refer to the exhibit. You run the PowerShell cmdlet and see that EnabledForDiskEncryption is false. You need to ensure that this key vault can be used for Azure Disk Encryption. What should you do?

Accepted Answer

Run Set-AzKeyVaultAccessPolicy with the -EnabledForDiskEncryption parameter. Azure Disk Encryption requires the key vault to have EnabledForDiskEncryption set to true. Option A is correct. Option B is incorrect because the parameter is for deployment. Option C is incorrect because the parameter is for template deployment. Option D is incorrect because the cmdlet sets the property for an existing vault.

Answer

Re-create the key vault with -EnabledForDiskEncryption parameter

Answer

Run Set-AzKeyVaultAccessPolicy with the -EnabledForDeployment parameter

Answer

Run Set-AzKeyVaultAccessPolicy with the -EnabledForTemplateDeployment parameter

Question 4

Refer to the exhibit. You are reviewing a KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

Count security events per user, per computer, per event type in the last hour. The query filters SecurityEvent for user accounts in the last hour, then summarizes the count of events by Account, Computer, and EventID. Option A is correct. Option B is incorrect because it does not filter for failed logins. Option C is incorrect because it does not filter for admin accounts. Option D is incorrect because it does not filter for specific event IDs.

Answer

List all administrator accounts that logged in

Answer

Identify failed logon attempts across all computers

Answer

Find the most common event IDs across all computers

Question 5

Which TWO of the following are features of Microsoft Defender for Cloud that help secure infrastructure? (Choose two.)

Accepted Answer

Secure Score. Secure Score (A) is a feature of Microsoft Defender for Cloud that aggregates security findings across your Azure subscriptions and provides a numerical score based on the implementation of security controls. It helps prioritize remediation actions by showing the potential score improvement for each recommendation, directly enabling infrastructure hardening.

Answer

Incident investigation

Answer

Privileged Identity Management

Answer

User and Entity Behavior Analytics (UEBA)

Question 6

Which THREE of the following are best practices for securing Azure Kubernetes Service (AKS) clusters? (Choose three.)

Accepted Answer

Enable Azure Policy for AKS to enforce pod security. Option A (enable Azure Policy for AKS), Option C (use managed identities), and Option D (enable network policies) are best practices. Option B is incorrect because RBAC should be enabled, not disabled. Option E is incorrect because secrets should be stored in Azure Key Vault, not in plain text.

Answer

Store secrets in ConfigMaps

Answer

Disable Kubernetes RBAC to simplify management

Question 7

Which TWO of the following are requirements for implementing Azure Disk Encryption on Windows VMs? (Choose two.)

Accepted Answer

The BitLocker Drive Encryption feature must be available (Windows). Option B (Key Vault with EnabledForDiskEncryption) and Option E (BitLocker feature available) are requirements. Option A is not required because the VM does not need a public IP. Option C is incorrect because Azure Backup is not required. Option D is incorrect because the VM must be a supported size, but any size is not correct.

Answer

The VM must be a supported VM size

Answer

The VM must have a public IP address

Answer

An Azure Backup vault in the same region

Question 8

Your organization uses Microsoft Defender for Office 365. You need to design a solution to protect users from malicious links in email. What should you configure?

Accepted Answer

Safe Links policy. Option A is correct because Safe Links in Defender for Office 365 scans and blocks malicious links in real time. Option B is incorrect because Safe Attachments is for attachments. Option C is incorrect because anti-spam policies handle spam. Option D is incorrect because anti-phishing policies handle phishing, not links specifically.

Answer

Anti-spam policy

Answer

Safe Attachments policy

Answer

Anti-phishing policy

Question 9

Your organization is designing a hybrid identity infrastructure with Microsoft Entra ID. You need to ensure that users can access on-premises applications using passwordless authentication and that the solution minimizes latency for authentication requests. What should you implement?

Accepted Answer

Use Microsoft Entra application proxy to publish the on-premises applications and enable passwordless authentication.. Option C is correct because Microsoft Entra application proxy provides secure remote access to on-premises web applications without requiring a VPN, and it can leverage passwordless authentication through Microsoft Entra ID. Option A is wrong because VPN introduces latency and does not inherently support passwordless. Option B is wrong because Microsoft Entra Domain Services is for domain-joined VMs, not for publishing apps. Option D is wrong because Web Application Proxy is a legacy on-premises component that does not integrate with passwordless.

Answer

Join the on-premises servers to Microsoft Entra Domain Services and use passwordless authentication.

Answer

Install Web Application Proxy (WAP) on-premises and integrate with Microsoft Entra ID for passwordless.

Answer

Deploy a VPN and use Microsoft Entra ID with passwordless sign-in.

Question 10

Your company plans to deploy Microsoft Defender for Cloud to secure a multi-cloud environment that includes Azure, AWS, and GCP. You need to ensure that security recommendations from all three cloud providers are centrally visible. What should you configure?

Accepted Answer

Onboard AWS and GCP accounts to Microsoft Defender for Cloud using the multicloud connectors feature.. Option B is correct because Microsoft Defender for Cloud can connect AWS and GCP accounts via the multicloud connectors, allowing centralized visibility of security recommendations. Option A is wrong because AWS Security Hub only shows AWS recommendations. Option C is wrong because Azure Policy does not natively assess AWS/GCP resources. Option D is wrong because Microsoft Sentinel is for SIEM/SOAR, not for CSPM recommendations.

Answer

Deploy Azure Policy on AWS and GCP using Azure Arc to enforce security policies.

Answer

Ingest security logs from AWS and GCP into Microsoft Sentinel and use workbooks to view recommendations.

Answer

Connect AWS accounts to AWS Security Hub and GCP accounts to Google Cloud Security Command Center, then view via a single pane of glass.

Question 11

Refer to the exhibit. You are reviewing an Azure Policy definition that denies deployment of virtual machines without encryption at host enabled. A developer reports they cannot deploy a VM that already has encryption at host enabled. What is the most likely cause?

Accepted Answer

The policy definition uses an incorrect field path for encryptionAtHost.. Option D is correct because the policy rule uses an incorrect field path for encryptionAtHost. The correct property path is 'Microsoft.Compute/virtualMachines/securityProfile/encryptionAtHost'. Option A is wrong because the effect is deny, not audit. Option B is wrong because the policy applies to all VMs, not just those without encryption. Option C is wrong because the deny effect is correctly targeting VMs with encryptionAtHost false, but the field path is wrong.

Answer

The policy applies to all VMs regardless of encryption setting.

Answer

The policy effect is 'audit' instead of 'deny', so it does not block deployment.

Answer

The policy is missing an exemption for the developer's subscription.

Question 12

Your organization is deploying Microsoft Intune to manage Windows 11 devices. You need to ensure that devices automatically receive security updates and that users cannot defer updates. Which configuration profile setting should you configure?

Accepted Answer

Create a Windows 10/11 Update Rings policy with a deadline for quality and feature updates.. Option A is correct because the Update rings policy in Intune allows configuring Windows Update settings, including setting deadlines for updates to prevent deferral. Option B is wrong because Compliance policies enforce device compliance but do not control update deferral. Option C is wrong because Device configuration policies are for settings like BitLocker, not update rings. Option D is wrong because Endpoint security policies include antivirus and firewall, not update rings.

Answer

Create a device configuration profile to enable automatic updates.

Answer

Create a compliance policy that requires the device to have the latest updates installed.

Answer

Create an endpoint security policy for Windows Defender Antivirus to enforce update installation.

Question 13

You are designing a network security architecture for an Azure application that uses Azure Front Door and Azure Application Gateway. The application must be protected from DDoS attacks and common web exploits. Application traffic should be inspected by a web application firewall (WAF) before reaching the backend. What is the recommended deployment order?

Accepted Answer

Azure Front Door with WAF in front of Azure Application Gateway with WAF.. Option B is correct because Azure Front Door should be the outermost layer for global DDoS protection and TLS termination, then Azure Application Gateway with WAF provides regional web application firewall inspection. Option A is wrong because that would inspect traffic at the gateway first, missing Front Door's global DDoS protection. Option C is wrong because placing WAF only at Front Door leaves backend traffic uninspected. Option D is wrong because Application Gateway should have WAF enabled for web exploit protection.

Answer

Azure Front Door with WAF only, no Application Gateway.

Answer

Azure Front Door without WAF in front of Azure Application Gateway without WAF.

Answer

Azure Application Gateway with WAF in front of Azure Front Door.

Question 14

Refer to the exhibit. You run the PowerShell command to retrieve information about a Managed HSM in Azure. The output shows that the HSM is in 'Provisioned' state and has two security domains. What is the purpose of the security domains?

Accepted Answer

To back up and restore the HSM's key material and configuration.. Option A is correct because Managed HSM security domains are used to back up the HSM's key material for disaster recovery. Option B is wrong because HSM pools are for standard Key Vault, not Managed HSM. Option C is wrong because private endpoints are configured separately. Option D is wrong because security domains are not for RBAC; RBAC is managed via Azure RBAC.

Answer

To manage the HSM's private endpoint connections.

Answer

To enable role-based access control (RBAC) for the HSM.

Answer

To define the HSM's network access and firewall rules.

Question 15

Your company uses Microsoft Sentinel for security operations. You need to detect brute-force attacks against Azure VMs by correlating failed sign-in events from multiple sources. Which data connector should you enable?

Accepted Answer

Windows Security Events via AMA (Azure Monitor Agent) connector.. Option C is correct because Windows Security Events via AMA can collect failed sign-in events (Event ID 4625) from Azure VMs. Option A is wrong because Azure Activity logs do not contain VM sign-in events. Option B is wrong because Azure AD sign-in logs are for cloud applications, not VM sign-ins. Option D is wrong because Syslog is for Linux VMs but the question does not specify OS.

Answer

Azure Active Directory (now Microsoft Entra ID) sign-in logs connector.

Answer

Syslog connector.

Answer

Azure Activity log connector.