SC-100 Design security solutions for infrastructure Practice Test 9 — 15 Questions

Question 1

You are designing a zero-trust network architecture for a hybrid environment using Azure Virtual WAN. You need to secure all traffic between on-premises sites and Azure virtual networks using Microsoft's security services. The solution should include next-generation firewall capabilities and TLS inspection. What should you deploy?

Accepted Answer

Deploy Azure Firewall Premium as the secured hub in Virtual WAN.. Option D is correct because Azure Firewall Premium provides next-generation firewall features including TLS inspection and IDPS, and it can be integrated with Azure Virtual WAN as a secured hub. Option A is wrong because Azure Firewall Standard lacks TLS inspection. Option B is wrong because NVAs in a hub require manual routing and do not integrate natively. Option C is wrong because Application Gateway is for web traffic, not for general network traffic inspection.

Answer

Deploy a third-party NVA in a spoke virtual network and route traffic through it.

Answer

Deploy Azure Firewall Standard as the secured hub in Virtual WAN.

Answer

Deploy Azure Application Gateway with WAF in each virtual network.

Question 2

Refer to the exhibit. You are reviewing an ARM template that deploys a storage account. The compliance team requires that all storage accounts use TLS 1.2 or higher. Does this template meet the requirement?

Accepted Answer

Yes, because minimumTlsVersion is set to TLS1_2.. Option A is correct because the template sets minimumTlsVersion to TLS1_2, which meets the requirement. Option B is wrong because the property is set correctly. Option C is wrong because the template uses a valid apiVersion. Option D is wrong because Standard_GRS is not related to TLS version.

Answer

Yes, because Standard_GRS automatically enforces TLS 1.2.

Answer

No, because supportsHttpsTrafficOnly only allows HTTPS but does not enforce TLS 1.2.

Answer

No, because the apiVersion is outdated and does not support TLS setting.

Question 3

Your organization is planning to deploy Microsoft Defender for Cloud Apps (formerly Cloud App Security). You need to discover shadow IT usage and control access to cloud apps. Which TWO capabilities should you enable? (Choose TWO.)

Accepted Answer

Conditional Access App Control. Options A and C are correct. Cloud Discovery (A) identifies shadow IT by analyzing traffic logs. Conditional Access App Control (C) enables real-time session controls. Option B is wrong because DLP policies are for data protection, not discovery or access control. Option D is wrong because device compliance is managed by Intune. Option E is wrong because MCAS does not scan on-premises apps.

Answer

Microsoft Intune device compliance policies

Answer

Data Loss Prevention (DLP) policies

Answer

On-premises app discovery via Microsoft Defender for Identity

Question 4

Your company is designing a secure baseline for Azure Linux virtual machines using Azure Policy. You need to ensure that all Linux VMs have SSH access restricted, disk encryption enabled, and vulnerability assessments installed. Which THREE built-in policies should you assign? (Choose THREE.)

Accepted Answer

[Preview]: Configure Linux VMs to install the Azure Security Agent for vulnerability assessment. Options A, B, and D are correct. A restricts SSH from the internet, B enables encryption, and D deploys vulnerability assessment. Option C is wrong because it requires Microsoft Antimalware, which is for Windows. Option E is wrong because it enforces Windows Defender Credential Guard, which is Windows-specific.

Answer

Microsoft Antimalware for Azure must be configured with automatic update

Answer

Windows Defender Credential Guard should be enabled on Windows VMs

Question 5

You are designing a backup strategy for Azure virtual machines using Azure Backup. The solution must support cross-region restore and provide 10 years of retention for compliance. Which THREE features should you enable? (Choose THREE.)

Accepted Answer

Cross-Region Restore. Options A, C, and E are correct. Cross-Region Restore (A) enables restoring to a paired region. Archive Tier (C) allows retention up to 10 years. Immutable vault (E) prevents deletion of backups. Option B is wrong because Azure Site Recovery is for disaster recovery, not backup retention. Option D is wrong because soft delete is for accidental deletion protection, not for long-term retention.

Answer

Azure Site Recovery replication

Answer

Soft Delete

Question 6

Your company uses Microsoft Purview to govern data across Azure and on-premises. You need to classify sensitive data such as credit card numbers in Azure SQL Database and apply automatic retention labels. What should you configure?

Accepted Answer

Create a scan in Microsoft Purview Data Map and apply retention labels based on classifications.. Option B is correct because Microsoft Purview Data Map can scan Azure SQL Database for sensitive data types like credit card numbers, and then apply retention labels automatically. Option A is wrong because Sensitivity labels are for classification, not retention. Option C is wrong because Microsoft Sentinel is for security analytics. Option D is wrong because Microsoft Defender for Cloud Apps is for cloud app security.

Answer

Enable Microsoft Defender for Cloud Apps to classify and label data in Azure SQL.

Answer

Configure sensitivity labels in Microsoft Purview Information Protection.

Answer

Use Microsoft Sentinel to detect credit card numbers and trigger a retention policy.

Question 7

You are designing a security solution for an Azure Kubernetes Service (AKS) cluster that runs containerized workloads. The cluster must be integrated with Microsoft Defender for Cloud for threat detection, and you need to ensure that container images are scanned for vulnerabilities before deployment. What should you configure?

Accepted Answer

Enable Azure Defender for Containers in Microsoft Defender for Cloud and integrate with Azure Container Registry for image scanning.. Option A is correct because Azure Defender for Containers provides vulnerability scanning for images in Azure Container Registry and threat detection for AKS. Option B is wrong because Azure Policy only enforces admission controls, not scanning. Option C is wrong because Microsoft Sentinel is for log analysis. Option D is wrong because Microsoft Defender for Cloud Apps is for cloud app security, not container scanning.

Answer

Enable Microsoft Defender for Cloud Apps to discover and assess container vulnerabilities.

Answer

Deploy Azure Policy for Kubernetes with built-in policies to enforce image scanning.

Answer

Configure Microsoft Sentinel to collect container logs and detect vulnerabilities.

Question 8

Your organization is implementing a security baseline for Windows 11 devices using Microsoft Intune. You need to ensure that BitLocker encryption is enabled on all devices and that recovery keys are stored in Microsoft Entra ID. Which policy type should you configure?

Accepted Answer

Endpoint security policy for disk encryption.. Option A is correct because Endpoint security policies in Intune include BitLocker settings that can enforce encryption and store recovery keys in Entra ID. Option B is wrong because Device configuration policies are for general settings, not for BitLocker specifically. Option C is wrong because Compliance policies can check for encryption but do not configure it. Option D is wrong because Update rings are for Windows Update settings.

Answer

Device configuration profile for administrative templates.

Answer

Update rings for Windows 10 and later.

Answer

Compliance policy for device encryption.

Question 9

Your company is designing a hybrid identity solution using Microsoft Entra ID. You need to ensure that users can access on-premises applications using modern authentication methods. The solution must support multi-factor authentication and Conditional Access policies. What should you implement?

Accepted Answer

Microsoft Entra application proxy. Option B is correct because Microsoft Entra application proxy provides secure remote access to on-premises web applications without requiring a VPN. It supports modern authentication, MFA, and Conditional Access. Option A is wrong because Microsoft Entra Connect is for directory synchronization, not application publishing. Option C is wrong because Azure AD Domain Services provides domain services like LDAP, not application proxy. Option D is wrong because Microsoft Intune is for device management, not application access.

Answer

Microsoft Entra Connect

Answer

Azure AD Domain Services

Answer

Microsoft Intune

Question 10

You are designing a network security solution for a multi-tier application hosted in Azure. The front-end web tier must be accessible from the internet, but the back-end database tier must only accept traffic from the front-end tier. Which Azure service should you use to enforce this restriction?

Accepted Answer

Network Security Groups (NSGs). Option A is correct because Network Security Groups (NSGs) can be used to filter traffic between subnets. By applying an NSG to the database subnet with a rule allowing inbound traffic only from the front-end subnet's IP range, you restrict access. Option B is wrong because Azure Firewall is a managed firewall service, but for simple subnet-level filtering, NSGs are more appropriate and cost-effective. Option C is wrong because Application Gateway is a layer 7 load balancer. Option D is wrong because Azure Bastion provides secure RDP/SSH access to VMs.

Answer

Azure Firewall

Answer

Azure Bastion

Answer

Application Gateway

Question 11

Your organization uses Microsoft Defender for Cloud to secure a hybrid environment. You need to ensure that security recommendations are automatically remediated for virtual machines. The solution must use Azure Policy and must be deployed at scale. What should you configure?

Accepted Answer

Create a remediation task for the policy that needs auto-remediation. Option C is correct because implementing a remediation task via Azure Policy can automatically remediate non-compliant resources. Defender for Cloud integrates with Azure Policy to allow automatic remediation. Option A is wrong because just assigning a policy initiative does not enable automatic remediation; a remediation task is needed. Option B is wrong because enabling auto-provisioning for Log Analytics deploys the agent, but does not remediate security configurations. Option D is wrong because custom Azure Policy definitions require manual assignment and remediation setup.

Answer

Create a custom Azure Policy definition with deployIfNotExists effect

Answer

Assign a built-in policy initiative to the management group

Answer

Enable auto-provisioning for the Log Analytics agent

Question 12

You are designing a security solution for containers in Azure Kubernetes Service (AKS). The solution must scan container images for vulnerabilities before deployment and enforce runtime security. Which combination of Microsoft Defender for Cloud features should you enable?

Accepted Answer

Microsoft Defender for Containers. Option B is correct because Defender for Containers provides vulnerability assessment for images and runtime threat detection for AKS clusters. Option A is wrong because Defender for Servers is for VMs, not containers. Option C is wrong because Defender for App Service protects web apps, not containers. Option D is wrong because Defender for Cloud's regulatory compliance does not provide vulnerability scanning or runtime protection.

Answer

Microsoft Defender for App Service

Answer

Microsoft Defender for Cloud regulatory compliance dashboard

Answer

Microsoft Defender for Servers

Question 13

Your company is implementing a zero-trust network architecture in Azure. You need to ensure that all network traffic between virtual machines is encrypted and authenticated, regardless of the virtual network they reside in. What should you implement?

Accepted Answer

Azure Virtual Network encryption. Option D is correct because Azure Virtual Network encryption encrypts all traffic between VMs within a virtual network, providing zero-trust encryption. Option A is wrong because VPN gateways provide site-to-site encryption, not intra-VNet encryption. Option B is wrong because Azure Firewall does not encrypt traffic. Option C is wrong because NSGs filter traffic but do not encrypt.

Answer

Azure VPN Gateway

Answer

Network Security Groups (NSGs)

Answer

Azure Firewall

Question 14

You need to design a backup and disaster recovery solution for Azure virtual machines that meets a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 1 hour. Which Azure service should you use?

Accepted Answer

Azure Site Recovery. Option B is correct because Azure Site Recovery provides replication with RPO as low as 30 seconds and RTO typically within minutes. Option A is wrong because Azure Backup provides longer RPO and RTO, typically hours. Option C is wrong because Azure VM snapshots are manual. Option D is wrong because Azure managed disks do not provide replication.

Answer

Azure managed disk

Answer

Azure VM snapshot

Answer

Azure Backup

Question 15

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to design a solution to detect brute-force attacks against Azure virtual machines. The solution should use Azure Activity Logs and Windows Security Events. What should you configure in Sentinel?

Accepted Answer

Create a scheduled analytics rule. Option C is correct because Sentinel can ingest Azure Activity Logs and Windows Events, and then use analytics rules to detect brute-force patterns. Option A is wrong because watchlists are for reference data, not detection logic. Option B is wrong because workbooks visualize data, not detect. Option D is wrong because playbooks automate responses, not detect.

Answer

Create a threat intelligence watchlist

Answer

Create a workbook

Answer

Create a playbook