SC-100 Design security solutions for infrastructure Practice Test 9 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only approved applications can run on corporate devices. Which Intune feature should you configure?

Accepted Answer

AppLocker. AppLocker (option D) is the correct choice because it is the Windows feature that lets administrators define and enforce rules specifying which applications users can run on managed devices, and it can be configured and deployed through Intune via an application control policy. This directly satisfies the requirement that only approved applications execute on corporate Windows 10 devices. Windows Defender Firewall (A) controls network traffic by port, protocol, and address, not which local applications are permitted to launch. BitLocker (B) provides full-disk encryption for data-at-rest protection and has no application execution control. Windows Information Protection (C) is designed to separate and protect corporate data from personal data, not to whitelist approved applications for execution.

Answer

Windows Defender Firewall

Answer

BitLocker

Answer

Windows Information Protection

Question 2

Your company uses Azure Firewall to filter outbound traffic from a virtual network. You need to allow only HTTP and HTTPS traffic to specific FQDNs, while blocking all other outbound traffic. Which Azure Firewall rule type should you use?

Accepted Answer

Application rule. Application rules in Azure Firewall allow filtering outbound traffic based on fully qualified domain names (FQDNs) for HTTP and HTTPS protocols. Option A is wrong because NAT rules only perform destination network address translation, not FQDN filtering. Option C is wrong because threat intelligence rules are used to block traffic from known malicious IP addresses, not for allowing FQDNs. Option D is wrong because network rules filter traffic based on IP addresses, ports, and protocols, not FQDNs.

Answer

NAT rule

Answer

Threat intelligence rule

Answer

Network rule

Question 3

You are designing a secure hybrid network connectivity solution between an on-premises datacenter and Azure. The requirement is to have encrypted traffic and high availability. Which service should you use?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway (option C) is correct because it establishes encrypted IPsec/IKE site-to-site tunnels between on-premises networks and Azure, and it supports high availability through active-active configurations, multiple gateway instances, and zone-redundant SKUs. This directly satisfies the stated requirements of encrypted traffic and high availability for hybrid connectivity. Azure ExpressRoute (option B) provides private, dedicated connectivity but does not natively encrypt traffic over the circuit, so it does not meet the encryption requirement by itself. Azure Front Door (option A) is a global HTTP/HTTPS application delivery and load-balancing service, not a hybrid network tunnel, and Azure Bastion (option D) provides secure RDP/SSH access to VMs over the Azure portal without exposing public IPs, not site-to-site hybrid connectivity.

Answer

Azure Front Door

Answer

Azure ExpressRoute

Answer

Azure Bastion

Question 4

You need to ensure that Azure SQL Database always encrypts data at rest and in transit. Which features should you enable?

Accepted Answer

Transparent Data Encryption (TDE) and enforce TLS connections. Transparent Data Encryption (TDE) and enforce TLS connections. TDE provides encryption of data at rest by encrypting the database, backups, and transaction logs at the page level, while enforcing TLS (Transport Layer Security) ensures data in transit is encrypted between the client and Azure SQL Database. Firewall rules, Microsoft Entra ID authentication, Always Encrypted, Azure Defender, and vulnerability assessment address access control, client-side encryption, or threat detection, but they do not by themselves guarantee encryption of data at rest and in transit. Therefore, options A, C, and D do not satisfy the stated requirement.

Answer

Firewall rules and Azure Active Directory authentication

Answer

Always Encrypted and firewall rules

Answer

Azure Defender for SQL and vulnerability assessment

Question 5

Your organization uses Microsoft Sentinel to monitor hybrid workloads. You need to design a solution to detect lateral movement attempts using pass-the-hash attacks. Which data source should you prioritize for ingestion?

Accepted Answer

Windows Security Events (Event ID 4624). The correct option is D, Windows Security Events (Event ID 4624), because pass-the-hash lateral movement is detected by analyzing logon events, and Event ID 4624 (successful logon) with Logon Type 3 (network) and NTLM authentication reveals the use of stolen NTLM hashes to authenticate to remote systems. Microsoft Sentinel's built-in analytics rules and the SecurityEvent table rely on these 4624 records to correlate anomalous NTLM logons across hosts. Option A (Sysmon Event ID 1) captures process creation and may show suspicious tools but does not directly record the authentication mechanism used in pass-the-hash. Option B (DNS Query Logs) and Option C (Azure Activity Logs) track name resolution and control-plane operations respectively, neither of which exposes NTLM network logon activity needed to detect pass-the-hash.

Answer

Sysmon Event ID 1 (Process creation)

Answer

DNS Query Logs

Answer

Azure Activity Logs

Question 6

Your company is designing a Zero Trust network for a hybrid workforce. Remote users connect via VPN to on-premises resources, while cloud apps use Microsoft Entra ID. You need to enforce conditional access based on device compliance and user risk. Which Microsoft security solution should you integrate with Entra ID to provide real-time device posture signals?

Accepted Answer

Microsoft Intune. Microsoft Intune provides device compliance policies and can send device posture signals to Entra ID Conditional Access. With Intune, you can enforce device health and compliance requirements before granting access. Option A is wrong because Microsoft Purview focuses on data governance and compliance, not device management. Option C is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) and does not directly manage device compliance. Option D is wrong because Microsoft Sentinel is a security information and event management (SIEM) solution and does not provide device posture signals.

Answer

Microsoft Purview

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 7

You are designing a secure infrastructure for an e-commerce platform hosted on Azure. The platform must meet PCI DSS compliance. Which Azure service should you use to centrally manage and monitor security policies across subscriptions?

Accepted Answer

Azure Policy. Azure Policy is the correct choice because it is the Azure service designed to centrally create, assign, and manage policy definitions that enforce and audit security and compliance rules across subscriptions, which directly supports PCI DSS governance at scale. It evaluates resources against built-in or custom policies and reports compliance state, making it suitable for monitoring policy adherence across multiple subscriptions. Azure Firewall (B) is a network security service that filters traffic but does not manage or monitor security policies across subscriptions. Microsoft Defender for Cloud (C) provides security posture management and threat protection, but it is not the primary mechanism for centrally defining and enforcing policy rules across subscriptions. Azure Blueprints (D) is used to package and deploy governed environments with artifacts like policies and role assignments, but it is not the central ongoing policy management and monitoring service.

Answer

Azure Firewall

Answer

Microsoft Defender for Cloud

Answer

Azure Blueprints

Question 8

A multinational corporation uses Microsoft Entra ID with hybrid identities. They need to design a solution that automatically remediates risky sign-ins without user intervention. Which feature should you enable?

Accepted Answer

Identity Protection with Conditional Access policies. The correct option is D: Identity Protection with Conditional Access policies, because Entra ID Identity Protection detects risky sign-ins and risk detections, and Conditional Access can automatically enforce remediation actions such as requiring MFA, blocking access, or forcing password reset without user intervention. This directly addresses the requirement for automatic remediation of risky sign-ins in a hybrid identity environment. Option A, Entra ID Governance Access Reviews, is for periodic attestation of access rights, not sign-in risk remediation. Option B, Privileged Identity Management, manages just-in-time privileged role activation and approvals, not risky sign-in response. Option C, Microsoft Defender for Identity, detects identity threats on-premises but does not itself automatically remediate Entra ID sign-in risk through Conditional Access.

Answer

Entra ID Governance (Access Reviews)

Answer

Privileged Identity Management (PIM)

Answer

Microsoft Defender for Identity

Question 9

Your company is migrating to Azure and needs to secure virtual networks with network segmentation. You need to design a solution that filters traffic between subnets based on application requirements. Which Azure service should you use?

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) are the correct choice because they are Azure's native stateful packet-filtering service that can be associated with subnets (and NICs) to allow or deny traffic based on rules using source/destination IP, port, and protocol, which directly enables subnet-level segmentation per application requirements. Azure Firewall is a managed, centralized Layer 3-7 firewall for broader perimeter and egress control, not the primary mechanism for filtering traffic between subnets. Azure DDoS Protection mitigates volumetric and protocol-layer attacks against public endpoints and does not segment or filter inter-subnet traffic. Azure Bastion provides secure RDP/SSH access to VMs over TLS without public IPs and performs no subnet traffic filtering.

Answer

Azure DDoS Protection

Answer

Azure Firewall

Answer

Azure Bastion

Question 10

Your organization uses Microsoft Defender for Cloud to assess security posture. You need to design a solution that automatically applies a security baseline to new Azure VMs. Which feature should you use?

Accepted Answer

Azure Policy with Guest Configuration. Azure Policy with Guest Configuration is the correct choice because it uses the Guest Configuration extension (via the Azure Connected Machine/VM agent) to audit and enforce OS-level settings inside Azure VMs, including applying security baselines such as the Windows or Linux security baseline definitions. It continuously evaluates machines against the policy and can deploy configuration assignments to new VMs automatically, which directly matches the requirement to apply a baseline to new Azure VMs. The regulatory compliance dashboard (A) only reports compliance status against standards and does not apply baselines. Azure Update Management (B) handles OS patch orchestration, not security baseline configuration. Azure Automation State Configuration (C) can apply DSC configurations but is a separate, more manual pull/push mechanism and is not the Defender for Cloud-integrated baseline enforcement feature.

Answer

Microsoft Defender for Cloud regulatory compliance dashboard

Answer

Azure Update Management

Answer

Azure Automation State Configuration (DSC)

Question 11

Your company uses Microsoft Intune to manage devices. You need to design a solution that prevents users from installing unauthorized applications on corporate Windows 10 devices. Which Intune policy should you configure?

Accepted Answer

Device restriction policy (Windows 10). A Device restriction policy (Windows 10), because this policy type includes settings that control app installation behavior on Windows 10 devices, such as blocking users from installing apps from untrusted sources or restricting Microsoft Store access. In Intune, device restriction policies are specifically designed to enforce hardware, software, and app-related restrictions on managed devices, making them the appropriate choice for preventing unauthorized application installations. A compliance policy (A) only evaluates and reports device state against conditions and can trigger conditional access, but it does not directly block app installation. An app protection policy (B) applies to mobile app management (MAM) for protecting corporate data within apps, not to blocking installation of unauthorized apps on Windows 10. A configuration policy using OMA-URI (D) can set custom CSP settings, but it is not the purpose-built policy for app installation restrictions that the device restriction policy provides.

Answer

Compliance policy

Answer

App protection policy (MAM)

Answer

Configuration policy (OMA-URI)

Question 12

Which TWO Azure services should you use to implement a defense-in-depth strategy for protecting Azure virtual machines?

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) are correct because they enforce network-layer defense-in-depth by filtering inbound and outbound traffic to and from Azure VMs using allow/deny security rules based on source/destination IP, port, and protocol, effectively segmenting and restricting access at the subnet or NIC level. Azure Backup is correct because it provides the data-recovery layer of defense-in-depth, protecting VM data against accidental deletion, corruption, or ransomware by creating recoverable recovery points stored in a Recovery Services vault. Azure Logic Apps is not a security control for VMs; it is a workflow-orchestration service for integrating apps and automating business processes. Azure Automation is a configuration-management and process-automation service (runbooks, DSC, update management) and does not itself provide a protective security boundary for VM traffic or data. Azure Front Door is a global layer-7 web application delivery and CDN/WAF service for HTTP/HTTPS workloads, not a mechanism for protecting Azure VMs directly.

Answer

Azure Logic Apps

Answer

Azure Automation

Answer

Azure Front Door

Question 13

You are designing a hybrid identity solution for an organization that uses Microsoft Entra ID and an on-premises Active Directory. The organization requires that users who are located in a remote office without a direct VPN connection to the main office can authenticate against on-premises resources using their Entra ID credentials. The solution must minimize latency and support passwordless authentication. Which feature should you implement?

Accepted Answer

Implement Microsoft Entra Kerberos authentication. Microsoft Entra Kerberos authentication enables users to authenticate to on-premises resources using their Entra ID credentials without requiring a VPN, and it supports passwordless methods like FIDO2 and Windows Hello for Business. Option A is incorrect because Entra Application Proxy is designed for publishing on-premises web applications, not for general authentication. Option C is incorrect because Conditional Access policies enforce access controls but do not provide authentication or passwordless capabilities. Option D is incorrect because Entra Connect Sync with password hash synchronization only syncs password hashes and does not support real-time passwordless authentication without a VPN.

Answer

Configure Microsoft Entra Application Proxy

Answer

Enable Microsoft Entra Conditional Access policies

Answer

Deploy Microsoft Entra Connect Sync with password hash synchronization

Question 14

Your organization is designing a secure network infrastructure for a multi-cloud environment that includes Azure, AWS, and on-premises datacenters. The security team requires that all traffic between these environments be inspected for threats and that any malicious traffic be automatically blocked. The solution must minimize complexity and use a single pane of glass for policy management. Which Azure service should you use as the central hub?

Accepted Answer

Azure Firewall. Azure Firewall (option D) is the correct choice because it provides a centralized, cloud-native firewall service that can inspect and filter traffic across Azure, AWS, and on-premises connections through a hub-and-spoke or Virtual WAN topology, with a single management plane via Azure Firewall Manager for policy and threat intelligence-based blocking. It supports FQDN filtering, threat intelligence, and IDPS, making it suitable for multi-cloud traffic inspection and automatic malicious traffic blocking while minimizing complexity. Azure Front Door (A) is a global HTTP/HTTPS load balancer and WAF for web applications, not a general network traffic inspection hub for multi-cloud and on-premises traffic. Network Security Groups (B) are stateful packet filters at the subnet/NIC level with no central management pane or advanced threat inspection. Azure DDoS Protection (C) only mitigates volumetric DDoS attacks against Azure resources and does not inspect or block general malicious traffic across hybrid and multi-cloud environments.

Answer

Azure Front Door

Answer

Network Security Groups (NSGs)

Answer

Azure DDoS Protection

Question 15

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure resources. The security team wants to ensure that all virtual machines are covered by Defender for Cloud's vulnerability assessment capabilities. Which plan must be enabled?

Accepted Answer

Microsoft Defender for Servers Plan 2. Microsoft Defender for Servers Plan 2 is the correct choice because it is the Defender for Cloud plan that includes built-in vulnerability assessment for Azure and hybrid virtual machines, using the integrated Microsoft Defender Vulnerability Management scanner. Enabling this plan on the subscription ensures VMs receive agentless or agent-based vulnerability scanning and findings surface in Defender for Cloud's recommendations. Microsoft Defender for Storage protects storage accounts, not VMs, so it does not provide VM vulnerability assessment. Microsoft Defender for Cloud Apps is a CASB solution for SaaS application visibility and control, and Defender CSPM provides posture management and attack path analysis but not the VM vulnerability assessment capability itself.

Answer

Microsoft Defender for Storage

Answer

Microsoft Defender for Cloud Apps

Answer

Defender Cloud Security Posture Management (CSPM)