SC-100 Design security solutions for infrastructure Practice Test 9 — 15 Questions

Question 1

Your organization is implementing a security baseline for Windows 11 devices using Microsoft Intune. You need to ensure that BitLocker encryption is enabled on all devices and that recovery keys are stored in Microsoft Entra ID. Which policy type should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Endpoint security policy for disk encryption.. Endpoint security policy for disk encryption, is correct because it provides BitLocker management settings in Intune, allowing you to enforce encryption and configure recovery key storage in Microsoft Entra ID. Option A is incorrect because Device configuration profiles (including administrative templates) do not include the specific BitLocker recovery key storage settings. Option C is incorrect because Update rings manage Windows Update settings, not encryption. Option D is incorrect because Compliance policies can only check encryption status, not enforce or configure it.

Answer

Device configuration profile for administrative templates.

Answer

Update rings for Windows 10 and later.

Answer

Compliance policy for device encryption.

Question 2

Your company is designing a hybrid identity solution using Microsoft Entra ID. You need to ensure that users can access on-premises applications using modern authentication methods. The solution must support multi-factor authentication and Conditional Access policies. What should you implement?

Accepted Answer

Microsoft Entra application proxy. Microsoft Entra application proxy provides secure remote access to on-premises web applications without requiring a VPN. It supports modern authentication, MFA, and Conditional Access. Option A is wrong because Microsoft Entra Connect is for directory synchronization, not application publishing. Option C is wrong because Azure AD Domain Services provides domain services like LDAP, not application proxy. Option D is wrong because Microsoft Intune is for device management, not application access.

Answer

Microsoft Entra Connect

Answer

Azure AD Domain Services

Answer

Microsoft Intune

Question 3

You are designing a network security solution for a multi-tier application hosted in Azure. The front-end web tier must be accessible from the internet, but the back-end database tier must only accept traffic from the front-end tier. Which Azure service should you use to enforce this restriction?

Accepted Answer

Network Security Groups (NSGs). (Network Security Groups) is correct because NSGs can filter traffic between subnets. By applying an NSG to the database subnet with a rule that allows inbound traffic only from the front-end subnet's IP address range (or virtual network), you can effectively restrict database access to only the front-end tier. Option A (Azure Firewall) is a managed firewall service that can also perform this function, but for simple subnet-level filtering within a virtual network, NSGs are more appropriate, cost-effective, and easier to manage. Option C (Application Gateway) is a layer-7 load balancer designed for HTTP/S traffic and does not provide network-layer filtering between subnets. Option D (Azure Bastion) provides secure RDP/SSH access to virtual machines and is not used for network traffic filtering.

Answer

Azure Firewall

Answer

Azure Bastion

Answer

Application Gateway

Question 4

Your organization uses Microsoft Defender for Cloud to secure a hybrid environment. You need to ensure that security recommendations are automatically remediated for virtual machines. The solution must use Azure Policy and must be deployed at scale. What should you configure?

Accepted Answer

Create a remediation task for the policy that needs auto-remediation. Creating a remediation task for a policy enables automatic remediation of non-compliant resources. Defender for Cloud integrates with Azure Policy to allow automatic remediation via remediation tasks. Option A is incorrect because a custom Azure Policy definition with deployIfNotExists effect requires a remediation task to actually apply the fix; without it, only new resources are evaluated. Option C is incorrect because assigning a policy initiative to a management group does not automatically remediate existing non-compliant resources; remediation tasks are necessary. Option D is incorrect because enabling auto-provisioning for the Log Analytics agent only deploys the agent, but does not remediate security configuration issues.

Answer

Create a custom Azure Policy definition with deployIfNotExists effect

Answer

Assign a built-in policy initiative to the management group

Answer

Enable auto-provisioning for the Log Analytics agent

Question 5

You are designing a security solution for containers in Azure Kubernetes Service (AKS). The solution must scan container images for vulnerabilities before deployment and enforce runtime security. Which combination of Microsoft Defender for Cloud features should you enable?

Accepted Answer

Microsoft Defender for Containers. Microsoft Defender for Containers provides vulnerability assessment for container images and runtime threat detection for AKS clusters. Option B (Defender for App Service) is wrong because it protects web apps, not containers. Option C (regulatory compliance dashboard) is wrong because it does not provide vulnerability scanning or runtime protection. Option D (Defender for Servers) is wrong because it protects VMs, not containers.

Answer

Microsoft Defender for App Service

Answer

Microsoft Defender for Cloud regulatory compliance dashboard

Answer

Microsoft Defender for Servers

Question 6

Your company is implementing a zero-trust network architecture in Azure. You need to ensure that all network traffic between virtual machines is encrypted and authenticated, regardless of the virtual network they reside in. What should you implement?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway provides encrypted site-to-site VPN connections between virtual networks, ensuring that all traffic between VMs in different VNets is encrypted and authenticated. This aligns with zero-trust principles by providing encryption regardless of network boundaries. Option B is incorrect because Azure Virtual Network encryption only encrypts traffic within the same VNet, not across VNets. Option C is incorrect because NSGs filter traffic but do not encrypt. Option D is incorrect because Azure Firewall filters and logs traffic but does not encrypt.

Answer

Azure Virtual Network encryption

Answer

Network Security Groups (NSGs)

Answer

Azure Firewall

Question 7

You need to design a backup and disaster recovery solution for Azure virtual machines that meets a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 1 hour. Which Azure service should you use?

Accepted Answer

Azure Site Recovery. Azure Site Recovery provides replication with RPO as low as 30 seconds and RTO typically within minutes, meeting the required 15-minute RTO and 1-hour RPO. Option B is wrong because Azure managed disks are a storage type and do not provide replication or recovery capabilities. Option C is wrong because Azure VM snapshots are manual and cannot guarantee the required RTO/RPO. Option D is wrong because Azure Backup typically offers longer RPO and RTO (hours), not suitable for the stated objectives.

Answer

Azure managed disk

Answer

Azure VM snapshot

Answer

Azure Backup

Question 8

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to design a solution to detect brute-force attacks against Azure virtual machines. The solution should use Azure Activity Logs and Windows Security Events. What should you configure in Sentinel?

Accepted Answer

Create a scheduled analytics rule. Sentinel can ingest Azure Activity Logs and Windows Events, and then use analytics rules to detect brute-force patterns. Option A is wrong because watchlists are for reference data, not detection logic. Option B is wrong because workbooks visualize data, not detect. Option D is wrong because playbooks automate responses, not detect.

Answer

Create a threat intelligence watchlist

Answer

Create a workbook

Answer

Create a playbook

Question 9

You are designing a security solution for an Azure SQL Database that stores sensitive customer data. The solution must encrypt the database at rest and in transit, and also mask sensitive columns from non-privileged users. Which combination of features should you implement?

Accepted Answer

Transparent Data Encryption (TDE) and Dynamic Data Masking (DDM). Transparent Data Encryption (TDE) encrypts the database at rest, and Dynamic Data Masking (DDM) masks sensitive columns from non-privileged users. Option B is wrong because Always Encrypt encrypts columns at the client side but does not encrypt the database at rest, and Row-Level Security controls access to rows, not masking. Option C is wrong because Always Encrypt does not provide at-rest encryption for the entire database and is not combined with DDM for this purpose. Option D is wrong because cell-level encryption is complex and not natively supported in Azure SQL Database, and row-level security does not mask columns.

Answer

Always Encrypted and Row-Level Security

Answer

Always Encrypted and Dynamic Data Masking (DDM)

Answer

Cell-level encryption and row-level security

Question 10

Your company plans to migrate on-premises servers to Azure. You need to ensure that the migrated servers are protected against malware and vulnerabilities. Which Microsoft Defender for Cloud plan should you enable for the Azure VMs?

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Servers provides malware protection, vulnerability assessment, and threat detection for Azure VMs, making it the correct plan for protecting migrated servers. Option A is wrong because Microsoft Defender for SQL is for SQL databases. Option B is wrong because Microsoft Defender for Storage is for storage accounts. Option C is wrong because Microsoft Defender for Containers is for container workloads. Option D (Microsoft Defender for Servers) is correct.

Answer

Microsoft Defender for SQL

Answer

Microsoft Defender for Storage

Answer

Microsoft Defender for Containers

Question 11

You are designing a secure access solution for on-premises applications using Microsoft Entra ID. The solution must support modern authentication, single sign-on (SSO), and Conditional Access. Which TWO technologies should you implement?

Accepted Answer

Microsoft Entra application proxy. Microsoft Entra application proxy publishes on-premises applications through Entra ID, enabling modern authentication, SSO, and Conditional Access. Option D is correct because Microsoft Entra ID serves as the identity provider, providing the authentication and authorization foundation for SSO and Conditional Access. Option A is incorrect because Azure AD B2C is designed for customer-facing applications, not for internal on-premises apps. Option B is incorrect because Microsoft Entra Domain Services provides legacy domain services and does not support modern authentication or Conditional Access natively. Option E is incorrect because a Site-to-Site VPN only provides network-level connectivity and does not provide identity-based access control or Conditional Access.

Answer

Azure AD B2C

Answer

Microsoft Entra Domain Services

Answer

Site-to-Site VPN

Question 12

You are designing a security solution for Azure resources using Azure Policy. You need to ensure that all storage accounts enforce HTTPS traffic and that only certain virtual networks can access them. Which THREE policy effects can you use to achieve this?

Accepted Answer

DeployIfNotExists. D, and E are correct. Deny prevents creation of non-compliant resources, Audit logs non-compliant resources, and DeployIfNotExists can deploy network rules. Option B is wrong because Append adds to existing resources but not for network rules. Option C is wrong because Modify changes properties, but not suitable for enforcing HTTPS.

Answer

Append

Answer

Modify

Question 13

Refer to the exhibit. You are reviewing an Azure Policy definition. What does this policy do?

Accepted Answer

Denies virtual machines with managed disks if the OS disk type is not Standard_LRS or Premium_LRS. The policy rule denies virtual machines if the OS disk managed disk storage account type is not Standard_LRS or Premium_LRS. It checks if the VM uses managed disks, and if so, only allows Standard_LRS or Premium_LRS. Option C correctly describes this behavior. Option A is incorrect because the policy does not require encryption at host. Option B is incorrect because it does not allow only unmanaged disks; in fact, it denies certain managed disk types. Option D is incorrect because it does not deny all VMs without managed disks; it only denies those with non-allowed managed disk types.

Answer

Requires all virtual machines to use encryption at host

Answer

Allows only virtual machines with unmanaged disks

Answer

Denies all virtual machines without managed disks

Question 14

Refer to the exhibit. You run the PowerShell command against an Azure SQL Database. The command returns a baseline object for rule VA2108. What does this indicate about the database's vulnerability assessment configuration?

Accepted Answer

The security team has approved the current state of rule VA2108 as acceptable. A baseline for rule VA2108 indicates that previous findings for that rule have been reviewed and marked as acceptable by the security team, so the rule will not appear as a vulnerability in future scans. Option A is incorrect because setting a baseline does not remediate findings automatically; it only exempts them. Option C is incorrect because vulnerability assessment is active—baselines are created based on scan results. Option D is incorrect because the existence of a baseline implies that there were previous findings that were approved, not that there are no findings.

Answer

The vulnerability assessment scan is automatically remediating findings for rule VA2108

Answer

Vulnerability assessment is disabled for this database

Answer

The database has no vulnerability findings

Question 15

Refer to the exhibit. You are deploying an ARM template that creates a network security group (NSG) named nsg-backend. What is the effect of this NSG on inbound traffic?

Accepted Answer

Only inbound traffic from 10.0.1.0/24 on port 80 is allowed; all other inbound traffic is denied. The NSG has two rules: AllowHTTPFromFrontend with priority 100 allows TCP 80 from 10.0.1.0/24, and DenyAllInbound with priority 1000 denies all other inbound traffic. Since the allow rule has a higher priority (lower number), traffic from the frontend subnet on port 80 is allowed, and all other inbound traffic is denied. Option A is wrong because traffic from 10.0.1.0/24 on port 80 is allowed. Option B is wrong because a default deny rule exists (DenyAllInbound). Option D is wrong because inbound traffic from 10.0.1.0/24 is allowed, not denied.

Answer

Only inbound traffic on port 80 is denied

Answer

All inbound traffic is allowed because no default deny rule is present

Answer

All inbound traffic is allowed except from 10.0.1.0/24