SC-100 Design security solutions for infrastructure Practice Test 8 — 15 Questions

Question 1

Your organization is deploying Azure SQL Managed Instance (SQL MI) with sensitive financial data. You need to design a security solution that includes data encryption at rest and in transit, threat detection, and fine-grained access control. The solution must also ensure that database administrators (DBAs) cannot access the data. What should you include?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable TDE and Always Encrypted for sensitive columns. Use Azure AD authentication. Enable Microsoft Defender for Cloud (SQL) for threat detection. Use Azure Policy to deny DBA access.. It provides a comprehensive security solution: TDE for at-rest encryption, Always Encrypted for column-level encryption (preventing even DBAs from reading sensitive columns), Microsoft Entra ID authentication to eliminate SQL authentication vulnerabilities, Microsoft Defender for Cloud (SQL) for threat detection, and Azure Policy to restrict DBA access. This combination addresses all requirements, including ensuring DBAs cannot access data.

Answer

Enable TDE and use server-level firewall rules. Use SQL authentication. Enable auditing.

Answer

Use client-side encryption with Always Encrypted. Use SQL authentication. Enable Advanced Threat Protection.

Answer

Enable TDE and use row-level security (RLS). Use Azure AD authentication. Enable Defender for SQL.

Question 2

Your organization is implementing a privileged access workstation (PAW) strategy for administrators managing Azure resources. The PAWs are Windows 11 devices enrolled in Intune. You need to ensure that only approved applications can run on PAWs, and that device users cannot disable security features. The solution must also enforce that PAWs are used exclusively for administrative tasks. What should you configure?

Accepted Answer

Configure Windows Defender Application Control (WDAC) and AppLocker policies in Intune to allow only approved administrative tools. Use Intune compliance policies to block non-compliant devices. Use Azure AD Conditional Access to require PAW as compliant.. To restrict applications on PAWs, you need Windows Defender Application Control (WDAC) and AppLocker policies, which can be deployed via Intune. Additionally, Intune compliance policies ensure devices meet security requirements, and Microsoft Entra Conditional Access enforces that only compliant PAWs can access administrative portals, ensuring they are used exclusively for admin tasks. Option A is about guest access, not app control. Option C uses PIM and Azure Policy, which do not control what applications run on the device. Option D uses MFA and device compliance but lacks application control, which is crucial for a PAW.

Answer

Enable Azure AD B2B collaboration for external admins. Use Intune to enforce device encryption.

Answer

Assign privileged roles using Azure AD Privileged Identity Management (PIM). Use Azure Policy to audit admin actions.

Answer

Use Azure AD Conditional Access to require multi-factor authentication and device compliance. Use Microsoft Defender for Cloud to monitor for admin activities.

Question 3

You are designing a security solution for a company that uses Azure Firewall Premium to protect a hub-and-spoke network. The security team wants to inspect outbound traffic for malicious patterns and block known malicious domains. They also want to minimize latency for legitimate traffic. You need to recommend a feature that meets these requirements. What should you recommend?

Accepted Answer

Enable IDPS in Azure Firewall Premium.. IDPS in Azure Firewall Premium provides signature-based intrusion detection and prevention, which inspects traffic for malicious patterns and can block them. It is designed for network-level inspection and does not require the overhead of TLS decryption, thus minimizing latency. Threat Intelligence only blocks known bad IPs and domains, not patterns. TLS Inspection adds latency. WAF is for web applications only.

Answer

Use Azure Web Application Firewall (WAF) on Azure Application Gateway.

Answer

Configure TLS Inspection in Azure Firewall Premium.

Answer

Enable Threat Intelligence in Azure Firewall.

Question 4

You are designing a security solution for Azure Kubernetes Service (AKS) clusters that will host microservices. The security team requires that (1) all container images be scanned for vulnerabilities before deployment, and (2) only images from a trusted registry be allowed. You need to recommend a solution that enforces these requirements at the cluster level. Which two actions should you include in your recommendation? (Choose two.)

Accepted Answer

Use Azure Container Registry (ACR) with image scanning enabled and configure AKS to pull images only from that registry using Azure Policy.. To meet both requirements, you need a solution that scans images for vulnerabilities and enforces that only trusted images are deployed. Azure Container Registry with image scanning enabled provides vulnerability scanning. Azure Policy can enforce that AKS pulls only from the trusted registry. Alternatively, OPA Gatekeeper can enforce admission control based on scan results and signatures. Both approaches provide the necessary scanning and enforcement.

Answer

Enable Microsoft Defender for Containers and configure the Azure Policy add-on for AKS to enforce image scanning and registry restrictions.

Answer

Configure network policies in AKS to restrict egress traffic to only the trusted registry.

Answer

Enable Azure Policy for AKS and assign the built-in policy to audit images from untrusted registries, but do not enforce.

Question 5

You are designing a security solution for Azure Kubernetes Service (AKS) clusters. You need to ensure that pod-to-pod communication is restricted to only necessary traffic and that network policies are enforced. You also want to simplify the management of network policies. Which two actions should you include in the solution? (Choose two.)

Accepted Answer

Enable the Calico network policy engine on the AKS cluster.. To enforce pod-to-pod communication restrictions in AKS, you need a network policy engine. Both Calico and Azure NPM are supported options that implement Kubernetes network policies. Enabling either one allows you to define and enforce policies that restrict traffic between pods. Azure CNI and Azure Policy for Kubernetes do not enforce network policies at the data plane, and NSGs operate at the subnet level, not pod level.

Answer

Use Azure Policy for Kubernetes to enforce network policies.

Answer

Configure network security groups (NSGs) on the AKS subnet.

Answer

Enable Azure CNI networking for the AKS cluster.

Question 6

You are the security architect for a company that uses Microsoft Defender for Cloud. The company has a hybrid environment with Azure virtual machines (VMs) and on-premises servers. You need to ensure that all servers are monitored for missing operating system updates and security misconfigurations. You want to minimize the deployment effort. What should you recommend?

Accepted Answer

Enable Microsoft Defender for Servers and use the built-in vulnerability assessment and security baseline recommendations in Defender for Cloud.. Microsoft Defender for Servers provides integrated vulnerability assessment and security baseline monitoring for both Azure and on-premises servers. When enabled in Defender for Cloud, it automatically assesses missing OS updates and security misconfigurations, requiring minimal deployment effort. It leverages Azure Arc for on-premises servers, ensuring consistent protection across the hybrid environment.

Answer

Use Microsoft Sentinel to collect security events from all servers and create custom analytics rules to detect missing updates.

Answer

Install the Log Analytics agent on all servers and enable the Update Management solution in Azure Automation.

Answer

Deploy Azure Arc to all on-premises servers and configure Azure Policy to audit OS updates.

Question 7

You are designing a security solution for a company that stores sensitive data in Azure SQL Database. The company requires that all connections to the database use encryption and that the database is protected from SQL injection attacks. You need to recommend a feature that meets these requirements with minimal configuration. What should you recommend?

Accepted Answer

Enforce SSL/TLS encryption and enable the SQL injection detection in Azure SQL Database.. Azure SQL Database enforces encrypted connections by default and allows configuration of the minimum TLS version. It also provides built-in SQL injection detection through features like Advanced Threat Protection or the built-in firewall and auditing. Enforcing SSL/TLS and enabling SQL injection detection together meet the requirements with minimal configuration.

Answer

Enable Advanced Threat Protection in Microsoft Defender for SQL.

Answer

Configure a firewall rule to allow only specific IP addresses.

Answer

Enable Transparent Data Encryption (TDE) on the database.

Question 8

You are designing a security solution for a company that uses Azure Virtual Machines (VMs) running Windows Server. The company wants to ensure that only trusted applications can run on the VMs and that any unauthorized application is blocked. The solution must minimize the impact on VM performance and not require rebooting the VMs. You need to recommend a solution. What should you recommend?

Accepted Answer

Enable Windows Defender Application Control (WDAC) with a code integrity policy.. Windows Defender Application Control (WDAC) enforces code integrity policies at the kernel level, allowing only trusted applications to run. It has minimal performance overhead and supports policy updates without reboots. AppLocker is an older technology with higher overhead and reboot requirements. ASR rules are behavioral and not comprehensive allowlisting. GPO software restrictions are less efficient and flexible.

Answer

Configure a Group Policy Object (GPO) to restrict software installation.

Answer

Use AppLocker to create rules that allow only trusted applications.

Answer

Deploy Microsoft Defender for Endpoint and configure attack surface reduction (ASR) rules.

Question 9

Your organization uses Microsoft Sentinel to monitor hybrid workloads. You need to design a solution to detect lateral movement attempts from compromised on-premises servers to Azure VMs. Which data connector should you prioritize?

Accepted Answer

Windows Security Events via AMA. Windows Security Events via AMA is the correct choice because lateral movement from compromised on-premises servers to Azure VMs is detected through Windows security event telemetry such as logon events (4624, 4625), explicit credential use (4648), and special privilege assignment (4672), which this connector collects from both on-premises and Azure Windows machines into Microsoft Sentinel. The Azure Monitor Agent (AMA) with the Windows Security Events data connector supports the hybrid, multi-cloud scope described, making it the priority connector for this detection scenario. Syslog via AMA is not appropriate because Syslog captures Linux/network appliance messages, not the Windows authentication events needed to trace lateral movement. Office 365 Logs cover cloud productivity audit activity, and Azure Activity Log records control-plane operations on Azure resources, neither of which provides the host-level Windows logon telemetry required here.

Answer

Syslog via AMA

Answer

Office 365 Logs

Answer

Azure Activity Log

Question 10

A company plans to use Microsoft Defender for Cloud to secure a multi-cloud environment including Azure, AWS, and GCP. What is the first step to enable multi-cloud visibility?

Accepted Answer

Connect AWS and GCP accounts using the cloud connectors in Defender for Cloud. Connect AWS and GCP accounts using the cloud connectors in Defender for Cloud. Defender for Cloud's native multi-cloud support requires onboarding non-Azure environments through the AWS and GCP connectors, which establish the necessary trust and inventory so that resources, recommendations, and alerts from those clouds become visible in the portal. Only after this connection can Defender plans, compliance policies, or agent-based extensions be applied to those resources. Option A is premature because enabling subscription-level Defender plans only affects Azure resources, not AWS or GCP. Option C is a later configuration step that depends on data already being collected, and Option D is not the onboarding mechanism for multi-cloud visibility, since Azure Arc is used for connecting specific servers rather than enabling cloud-wide AWS/GCP visibility.

Answer

Enable all Defender plans for subscription

Answer

Create custom compliance policies

Answer

Deploy Azure Arc agents on all cloud VMs

Question 11

Which TWO Azure policies should you assign to enforce secure configuration of Azure SQL Database? (Select two.)

Accepted Answer

Ensure that 'Auditing' is set to 'On' for SQL Database. Option A is correct because the built-in Azure Policy 'Auditing on SQL Database should be enabled' enforces that auditing is set to 'On' for Azure SQL Database, ensuring database activity is logged for security and compliance monitoring. Option D is correct because the policy 'Firewall and virtual network settings for SQL Database should be configured' enforces that Azure SQL Database has network-level access controls (firewall rules or virtual network service endpoints/private endpoints) in place, restricting access to authorized networks only. Option B is incorrect because it targets TDE on SQL Server running on VMs (IaaS), not Azure SQL Database (PaaS), so it does not apply to this scenario. Option C is incorrect because it audits the SQL Server-level audit setting rather than enforcing a secure configuration on Azure SQL Database itself. Option E is incorrect because it concerns secure transfer for storage accounts, which is unrelated to Azure SQL Database configuration.

Answer

Ensure that 'TDE' is enabled for SQL Server VMs

Answer

Audit SQL Server level audit setting

Answer

Ensure secure transfer to storage accounts is enabled

Question 12

Which THREE features of Microsoft Defender for Cloud help secure Azure Kubernetes Service (AKS) clusters? (Select three.)

Accepted Answer

Azure Defender for Kubernetes (cluster hardening). Azure Defender for Kubernetes (option B) is correct because it provides cluster hardening by continuously assessing AKS configurations against CIS Kubernetes benchmark controls and surfacing misconfiguration recommendations in Microsoft Defender for Cloud. Vulnerability assessment for container images (option C) is correct because Defender for Cloud scans images stored in Azure Container Registry and images running in AKS, using Qualys-based scanning to detect known CVEs in OS packages and language dependencies. Runtime threat detection for AKS clusters (option E) is correct because Defender for Containers monitors AKS node and workload activity via eBPF-based sensors and Kubernetes audit logs to alert on suspicious behavior such as crypto-mining, privilege escalation, and anomalous process execution. Option A does not belong because Advanced threat protection for Azure Cosmos DB protects database accounts, not AKS clusters. Option D does not belong because DDoS Protection Standard mitigates volumetric network attacks at the Azure edge and is not an AKS workload security feature of Defender for Cloud.

Answer

Advanced threat protection for Azure Cosmos DB

Answer

DDoS Protection Standard

Question 13

Which TWO actions should you take to improve the security posture of an Azure subscription using Microsoft Defender for Cloud? (Select two.)

Accepted Answer

Enable Azure Defender plans for all supported resource types. Option B is correct because enabling Microsoft Defender (Azure Defender) plans for all supported resource types activates the advanced threat protection and workload protection capabilities in Microsoft Defender for Cloud, such as Defender for Servers, Defender for Storage, and Defender for SQL, which provide detection and alerting beyond the free Secure Score recommendations. Option C is correct because acting on the top security recommendations surfaced by Secure Score directly remediates the highest-impact misconfigurations and control gaps, which is the intended workflow for measurably improving the subscription's security posture. Option A is not the best choice because Azure Policy enforces compliance with organizational standards but does not itself provide the threat protection and prioritized remediation that Defender for Cloud is designed to deliver. Option D is not correct because custom security policies are a governance customization rather than a Defender for Cloud posture-improvement action. Option E is not correct because deploying a vulnerability assessment solution is only one specific recommendation within Defender for Servers and is narrower than enabling the full Defender plans and acting on top recommendations.

Answer

Assign Azure Policy to enforce resource compliance

Answer

Create custom security policies

Answer

Deploy vulnerability assessment solution to all VMs

Question 14

Refer to the exhibit. You are reviewing an Azure Policy definition. What does this policy accomplish?

Accepted Answer

Denies creation of network security rules that allow traffic to ports other than 22 and 3389. The correct option is D: the policy denies creation of network security rules that allow traffic to ports other than 22 and 3389. Azure Policy definitions with a deny effect evaluate the properties of a resource being deployed—here, the destinationPortRange of a network security rule—and block the deployment when the condition is met, so rules permitting any port outside 22 and 3389 are rejected. Option A is wrong because the policy does not require ports to fall within a range; it blocks rules that allow ports other than the two specified. Option B is wrong because the policy targets NSG rule definitions in Azure Resource Manager, not live inbound traffic flows. Option C is wrong because the policy does not permit or allow traffic; it only denies noncompliant rule creation.

Answer

Requires that all network security rules have destination port range between 22 and 3389

Answer

Denies all inbound traffic except SSH and RDP

Answer

Allows only SSH and RDP inbound traffic

Question 15

Refer to the exhibit. You need to ensure that the storage account 'seccorpstorage' is only accessible from a specific Azure virtual network. What should you do?

Accepted Answer

Add a virtual network rule for the specific VNet. The correct answer is A: Add a virtual network rule for the specific VNet. In Azure Storage, network access restrictions are configured on the storage account's Networking blade, where you can add virtual network rules that allow access only from selected VNets and subnets; this directly satisfies the requirement that 'seccorpstorage' be accessible only from a specific Azure virtual network. Option B is incomplete because enabling the Microsoft.Storage service endpoint on the subnet is a prerequisite that makes the subnet eligible, but the storage account still needs the corresponding virtual network rule to actually restrict access. Option C is wrong because an IP-based firewall rule uses public IP addresses and does not restrict access to a specific VNet's private traffic. Option D is wrong because enabling public network access opens the account to public connectivity rather than limiting it to one VNet.

Answer

Enable the service endpoint for Microsoft.Storage on the VNet subnet

Answer

Enable firewall and add an IP rule for the VNet's public IP

Answer

Enable public network access and add a firewall rule