SC-100 Design security solutions for infrastructure Practice Test 8 — 15 Questions

Question 1

Which THREE of the following are best practices for securing Azure Kubernetes Service (AKS) clusters? (Choose three.)

Accepted Answer

Enable Azure Policy for AKS to enforce pod security. The correct best practices are: Enable Azure Policy for AKS to enforce pod security (A), Use managed identities for pod authentication (B), and Enable network policies to restrict pod traffic (D). Storing secrets in ConfigMaps (C) is insecure; secrets should be stored in Azure Key Vault. Disabling Kubernetes RBAC (E) is not a best practice; RBAC should be enabled for fine-grained access control.

Answer

Store secrets in ConfigMaps

Answer

Disable Kubernetes RBAC to simplify management

Question 2

Which TWO of the following are requirements for implementing Azure Disk Encryption on Windows VMs? (Choose two.)

Accepted Answer

The BitLocker Drive Encryption feature must be available (Windows). Azure Disk Encryption for Windows VMs requires the BitLocker Drive Encryption feature to be available on the VM (option A) and that the VM is a supported size (option B). While an Azure Key Vault is used for encryption keys, the EnabledForDiskEncryption property is automatically enabled when you enable disk encryption, so it is not a prerequisite that needs to be set beforehand. A public IP address and an Azure Backup vault are not required.

Answer

The VM must have a public IP address

Answer

An Azure Key Vault with the EnabledForDiskEncryption property set to true

Answer

An Azure Backup vault in the same region

Question 3

Your organization uses Microsoft Defender for Office 365. You need to design a solution to protect users from malicious links in email. What should you configure?

Accepted Answer

Safe Links policy. Safe Links in Microsoft Defender for Office 365 provides real-time scanning and blocking of malicious links in emails. Safe Attachments (Option B) deals with email attachments, Anti-spam policy (Option A) handles spam filtering, and Anti-phishing policy (Option D) protects against phishing attempts but does not specifically focus on link scanning. Therefore, Safe Links policy is the correct configuration.

Answer

Anti-spam policy

Answer

Safe Attachments policy

Answer

Anti-phishing policy

Question 4

Your company plans to deploy Microsoft Defender for Cloud to secure a multi-cloud environment that includes Azure, AWS, and GCP. You need to ensure that security recommendations from all three cloud providers are centrally visible. What should you configure?

Accepted Answer

Onboard AWS and GCP accounts to Microsoft Defender for Cloud using the multicloud connectors feature.. Microsoft Defender for Cloud's multicloud connectors allow onboarding AWS and GCP accounts, enabling centralized visibility of security recommendations from all three providers. Option B is wrong because Azure Policy cannot natively assess AWS or GCP resources; Azure Arc extends Azure management but does not enforce policies on non-Azure clouds for security recommendations. Option C is wrong because Microsoft Sentinel is a SIEM/SOAR tool, not a CSPM tool; it ingests logs but does not provide native security recommendations for cloud infrastructure. Option D is wrong because connecting to AWS Security Hub and GCP Security Command Center separately does not provide a single pane of glass; you would need to aggregate those views manually, whereas Defender for Cloud provides unified recommendations.

Answer

Deploy Azure Policy on AWS and GCP using Azure Arc to enforce security policies.

Answer

Ingest security logs from AWS and GCP into Microsoft Sentinel and use workbooks to view recommendations.

Answer

Connect AWS accounts to AWS Security Hub and GCP accounts to Google Cloud Security Command Center, then view via a single pane of glass.

Question 5

Refer to the exhibit. You are reviewing an Azure Policy definition that denies deployment of virtual machines without encryption at host enabled. A developer reports they cannot deploy a VM that already has encryption at host enabled. What is the most likely cause?

Accepted Answer

The policy definition uses an incorrect field path for encryptionAtHost.. The policy definition likely uses an incorrect field path for 'encryptionAtHost'. The proper path is 'Microsoft.Compute/virtualMachines/securityProfile/encryptionAtHost'. If the path is wrong, the policy cannot correctly evaluate the encryption setting, so it denies even compliant VMs. Option A is incorrect because the policy targets VMs without encryption, not all VMs. Option B is incorrect because the effect is 'deny', not 'audit', and the developer reports a blocking error. Option D is incorrect because an exemption would not fix a misconfigured policy rule; the issue lies in the policy definition itself.

Answer

The policy applies to all VMs regardless of encryption setting.

Answer

The policy effect is 'audit' instead of 'deny', so it does not block deployment.

Answer

The policy is missing an exemption for the developer's subscription.

Question 6

Your organization is deploying Microsoft Intune to manage Windows 11 devices. You need to ensure that devices automatically receive security updates and that users cannot defer updates. Which configuration profile setting should you configure?

Accepted Answer

Create a Windows 10/11 Update Rings policy with a deadline for quality and feature updates.. The Windows 10/11 Update Rings policy in Microsoft Intune allows configuring Windows Update settings, including setting deadlines for quality and feature updates, which ensures devices automatically receive updates and users cannot defer them. Option A is incorrect because a device configuration profile can enable automatic updates but does not enforce deadlines to prevent deferral. Option C is incorrect because a compliance policy checks device state but does not control update deferral behavior. Option D is incorrect because an endpoint security policy for Windows Defender Antivirus focuses on antivirus settings, not Windows Update ring policies.

Answer

Create a device configuration profile to enable automatic updates.

Answer

Create a compliance policy that requires the device to have the latest updates installed.

Answer

Create an endpoint security policy for Windows Defender Antivirus to enforce update installation.

Question 7

Refer to the exhibit. You run the PowerShell command to retrieve information about a Managed HSM in Azure. The output shows that the HSM is in 'Provisioned' state and has two security domains. What is the purpose of the security domains?

Accepted Answer

To back up and restore the HSM's key material and configuration.. Security domains in Azure Managed HSM are a critical feature for disaster recovery. They allow you to back up the HSM's key material and configuration, enabling restoration in case of failure. Option A is incorrect because private endpoint connections are managed separately, not through security domains. Option C is wrong because RBAC is handled via Azure RBAC or local RBAC, not security domains. Option D is wrong because network access and firewall rules are configured on the HSM's networking settings, not through security domains.

Answer

To manage the HSM's private endpoint connections.

Answer

To enable role-based access control (RBAC) for the HSM.

Answer

To define the HSM's network access and firewall rules.

Question 8

Your company uses Microsoft Sentinel for security operations. You need to detect brute-force attacks against Azure VMs by correlating failed sign-in events from multiple sources. Which data connector should you enable?

Accepted Answer

Windows Security Events via AMA (Azure Monitor Agent) connector.. Windows Security Events via AMA (Azure Monitor Agent) can collect failed sign-in events (Event ID 4625) from Azure VMs. Option A is incorrect because Azure AD sign-in logs capture sign-ins to cloud applications and Azure AD itself, not OS-level sign-ins to VMs. Option B is incorrect because Syslog is typically used for Linux VMs and the question does not specify the OS, whereas the correct connector for Windows VMs is Windows Security Events via AMA. Option D is incorrect because Azure Activity log records Azure resource management operations, not the guest OS sign-in events.

Answer

Azure Active Directory (now Microsoft Entra ID) sign-in logs connector.

Answer

Syslog connector.

Answer

Azure Activity log connector.

Question 9

You are designing a zero-trust network architecture for a hybrid environment using Azure Virtual WAN. You need to secure all traffic between on-premises sites and Azure virtual networks using Microsoft's security services. The solution should include next-generation firewall capabilities and TLS inspection. What should you deploy?

Accepted Answer

Deploy Azure Firewall Premium as the secured hub in Virtual WAN.. Azure Firewall Premium provides next-generation firewall features including TLS inspection and IDPS, and it can be integrated with Azure Virtual WAN as a secured hub. Option A is wrong because while a third-party NVA can be deployed, it does not natively integrate with Virtual WAN and requires manual routing and management. Option B is wrong because Azure Firewall Standard does not support TLS inspection. Option C is wrong because Azure Application Gateway is designed for web traffic and not for general network traffic inspection.

Answer

Deploy a third-party NVA in a spoke virtual network and route traffic through it.

Answer

Deploy Azure Firewall Standard as the secured hub in Virtual WAN.

Answer

Deploy Azure Application Gateway with WAF in each virtual network.

Question 10

Refer to the exhibit. You are reviewing an ARM template that deploys a storage account. The compliance team requires that all storage accounts use TLS 1.2 or higher. Does this template meet the requirement?

Accepted Answer

Yes, because minimumTlsVersion is set to TLS1_2.. The template sets 'minimumTlsVersion' to 'TLS1_2', which explicitly enforces TLS 1.2 or higher. Option A is incorrect because Standard_GRS is a replication type and does not control TLS version. Option C is incorrect because 'supportsHttpsTrafficOnly' only enforces HTTPS but does not specify the TLS version; the requirement is met by 'minimumTlsVersion'. Option D is incorrect because the apiVersion used in the template supports the 'minimumTlsVersion' property.

Answer

Yes, because Standard_GRS automatically enforces TLS 1.2.

Answer

No, because supportsHttpsTrafficOnly only allows HTTPS but does not enforce TLS 1.2.

Answer

No, because the apiVersion is outdated and does not support TLS setting.

Question 11

Your organization is planning to deploy Microsoft Defender for Cloud Apps (formerly Cloud App Security). You need to discover shadow IT usage and control access to cloud apps. Which TWO capabilities should you enable? (Choose TWO.)

Accepted Answer

Conditional Access App Control. Cloud Discovery (E) identifies shadow IT by analyzing traffic logs from firewalls and proxies to discover cloud app usage. Conditional Access App Control (A) enables real-time session controls for access policies. Option B is incorrect because Intune device compliance policies manage device health, not cloud app discovery or access control. Option C is incorrect because DLP policies protect data, not discover shadow IT or control access. Option D is incorrect because on-premises app discovery is not a capability of Defender for Cloud Apps; it focuses on cloud apps.

Answer

Microsoft Intune device compliance policies

Answer

Data Loss Prevention (DLP) policies

Answer

On-premises app discovery via Microsoft Defender for Identity

Question 12

Your company is designing a secure baseline for Azure Linux virtual machines using Azure Policy. You need to ensure that all Linux VMs have SSH access restricted, disk encryption enabled, and vulnerability assessments installed. Which THREE built-in policies should you assign? (Choose THREE.)

Accepted Answer

[Preview]: Configure Linux VMs to install the Azure Security Agent for vulnerability assessment. Options B, D, and E are correct. Option B configures Linux VMs to install the Azure Security Agent for vulnerability assessment. Option D ensures disk encryption is applied on virtual machines. Option E ensures Linux machines meet the Azure compute security baseline, which includes SSH restriction and other security configurations. Option A is incorrect because it configures Microsoft Antimalware, which is for Windows, not Linux. Option C is incorrect because Windows Defender Credential Guard is for Windows VMs, not Linux.

Answer

Microsoft Antimalware for Azure must be configured with automatic update

Answer

Windows Defender Credential Guard should be enabled on Windows VMs

Question 13

You are designing a backup strategy for Azure virtual machines using Azure Backup. The solution must support cross-region restore and provide 10 years of retention for compliance. Which THREE features should you enable? (Choose THREE.)

Accepted Answer

Cross-Region Restore. Options A, D, and E are correct. Cross-Region Restore (A) enables restoring backups to a paired Azure region for disaster recovery. Immutable vault (D) provides immutability, preventing backup deletion or modification until the retention period expires. Archive Tier (E) allows long-term retention of backups for up to 10 years at low cost. Option B (Azure Site Recovery) is for disaster recovery replication, not backup retention. Option C (Soft Delete) protects against accidental deletion but does not provide long-term retention.

Answer

Azure Site Recovery replication

Answer

Soft Delete

Question 14

Your company uses Microsoft Purview to govern data across Azure and on-premises. You need to classify sensitive data such as credit card numbers in Azure SQL Database and apply automatic retention labels. What should you configure?

Accepted Answer

Create a scan in Microsoft Purview Data Map and apply retention labels based on classifications.. Microsoft Purview Data Map can scan Azure SQL Database for sensitive data types like credit card numbers using built-in classifiers, and then automatically apply retention labels based on those classifications. Option B is incorrect because Microsoft Defender for Cloud Apps is focused on cloud app security, not data classification and retention labeling in databases. Option C is incorrect because sensitivity labels in Microsoft Purview Information Protection are for classification and protection (like encryption), but the question specifically asks for retention labels, which are handled by retention policies and labels. Option D is incorrect because Microsoft Sentinel is a SIEM for security analytics, not for data classification and retention labeling.

Answer

Enable Microsoft Defender for Cloud Apps to classify and label data in Azure SQL.

Answer

Configure sensitivity labels in Microsoft Purview Information Protection.

Answer

Use Microsoft Sentinel to detect credit card numbers and trigger a retention policy.

Question 15

You are designing a security solution for an Azure Kubernetes Service (AKS) cluster that runs containerized workloads. The cluster must be integrated with Microsoft Defender for Cloud for threat detection, and you need to ensure that container images are scanned for vulnerabilities before deployment. What should you configure?

Accepted Answer

Enable Azure Defender for Containers in Microsoft Defender for Cloud and integrate with Azure Container Registry for image scanning.. Azure Defender for Containers (part of Microsoft Defender for Cloud) provides vulnerability scanning for container images stored in Azure Container Registry and integrates with AKS for threat detection. Option A is incorrect because Microsoft Defender for Cloud Apps is designed for SaaS application security, not container image scanning. Option B is incorrect because Azure Policy for Kubernetes enforces admission controls but does not perform image scanning; scanning is a separate function of Defender for Containers. Option D is incorrect because Microsoft Sentinel is a security information and event management (SIEM) tool for log analysis, not vulnerability scanning.

Answer

Enable Microsoft Defender for Cloud Apps to discover and assess container vulnerabilities.

Answer

Deploy Azure Policy for Kubernetes with built-in policies to enforce image scanning.

Answer

Configure Microsoft Sentinel to collect container logs and detect vulnerabilities.