SC-100 Design security solutions for infrastructure — Timed 30 Questions

Question 1

Your organization uses Microsoft Sentinel to monitor hybrid workloads. You need to design a solution to detect lateral movement attempts from compromised on-premises servers to Azure VMs. Which data connector should you prioritize?

Accepted Answer

Windows Security Events via AMA. Option B is correct because the Windows Security Events via AMA connector provides the necessary event IDs (e.g., 4624, 4625) for lateral movement detection on Azure VMs. Option A is wrong because Azure Activity Log does not capture OS-level events. Option C is wrong because Syslog via AMA covers Linux but not Windows. Option D is wrong because Office 365 connector is for cloud app activity.

Answer

Syslog via AMA

Answer

Office 365 Logs

Answer

Azure Activity Log

Question 2

A company plans to use Microsoft Defender for Cloud to secure a multi-cloud environment including Azure, AWS, and GCP. What is the first step to enable multi-cloud visibility?

Accepted Answer

Connect AWS and GCP accounts using the cloud connectors in Defender for Cloud. Option C is correct because you must first onboard the AWS/GCP accounts into Defender for Cloud by connecting them via the native cloud connectors. Option A is wrong because deploying Azure Arc agents is for on-premises servers, not cloud accounts. Option B is wrong because enabling Defender plans is done after onboarding. Option D is wrong because custom policies are optional.

Answer

Enable all Defender plans for subscription

Answer

Create custom compliance policies

Answer

Deploy Azure Arc agents on all cloud VMs

Question 3

You are designing a secure DevOps pipeline using GitHub Advanced Security and Microsoft Defender for Cloud. The development team uses a mix of Python and JavaScript. Which tool should you integrate to detect secrets (e.g., API keys) committed to the repository?

Accepted Answer

GitHub secret scanning. Option A is correct because GitHub secret scanning automatically detects secrets in repositories. Option B is wrong because Dependabot focuses on dependency vulnerabilities. Option C is wrong because CodeQL analyzes code for security vulnerabilities, not secrets. Option D is wrong because Defender for Cloud’s DevOps security posture management does not replace secret scanning.

Answer

CodeQL code scanning

Answer

Dependabot alerts

Answer

Defender for Cloud DevOps security posture management

Question 4

Which TWO Azure policies should you assign to enforce secure configuration of Azure SQL Database? (Select two.)

Accepted Answer

Ensure that 'Auditing' is set to 'On' for SQL Database. Option A is correct because enabling Auditing on Azure SQL Database captures all database events and writes them to an audit log in your Azure storage account, Log Analytics workspace, or Event Hubs. This is a fundamental security control for compliance and forensic analysis, as it provides a record of who did what and when, which is essential for detecting and investigating unauthorized access or changes.

Answer

Ensure that 'TDE' is enabled for SQL Server VMs

Answer

Audit SQL Server level audit setting

Answer

Ensure secure transfer to storage accounts is enabled

Question 5

Which THREE features of Microsoft Defender for Cloud help secure Azure Kubernetes Service (AKS) clusters? (Select three.)

Accepted Answer

Azure Defender for Kubernetes (cluster hardening). Azure Defender for Kubernetes (now part of Microsoft Defender for Cloud's cloud workload protection) provides cluster hardening recommendations by assessing AKS cluster configurations against industry benchmarks like CIS. It identifies misconfigurations such as overly permissive RBAC roles, insecure network policies, or unencrypted secrets, and offers remediation steps to reduce the attack surface.

Answer

Advanced threat protection for Azure Cosmos DB

Answer

DDoS Protection Standard

Question 6

Which TWO actions should you take to improve the security posture of an Azure subscription using Microsoft Defender for Cloud? (Select two.)

Accepted Answer

Enable Azure Defender plans for all supported resource types. Options A and B are correct because enabling Defender plans and implementing recommendations improve security. Option C is wrong because Defender for Cloud already provides recommendations. Option D is wrong because vulnerability assessment for VMs is a feature, not a specific action. Option E is wrong because assigning Azure Policy is a method, but the most direct actions are enabling plans and implementing recommendations.

Answer

Assign Azure Policy to enforce resource compliance

Answer

Create custom security policies

Answer

Deploy vulnerability assessment solution to all VMs

Question 7

Refer to the exhibit. You are reviewing an Azure Policy definition. What does this policy accomplish?

Accepted Answer

Denies creation of network security rules that allow traffic to ports other than 22 and 3389. Option C is correct because the policy denies security rules that allow ports other than 22 (SSH) and 3389 (RDP) as destination ports. Option A is wrong because it allows only specific ports. Option B is wrong because it allows those ports. Option D is wrong because it doesn't enforce a specific range.

Answer

Requires that all network security rules have destination port range between 22 and 3389

Answer

Denies all inbound traffic except SSH and RDP

Answer

Allows only SSH and RDP inbound traffic

Question 8

Refer to the exhibit. You need to ensure that the storage account 'seccorpstorage' is only accessible from a specific Azure virtual network. What should you do?

Accepted Answer

Add a virtual network rule for the specific VNet. Option B is correct because you need to add a virtual network rule to allow traffic from the VNet. The current configuration has no rules, so all traffic is denied. Option A is wrong because the storage account already has public network access disabled. Option C is wrong because enabling firewall and adding IP rules would allow specific IPs, not a VNet. Option D is wrong because adding a service endpoint alone is incomplete without the rule.

Answer

Enable the service endpoint for Microsoft.Storage on the VNet subnet

Answer

Enable firewall and add an IP rule for the VNet's public IP

Answer

Enable public network access and add a firewall rule

Question 9

Refer to the exhibit. You are deploying an ARM template for a network security group. What is the security implication of this configuration?

Accepted Answer

The rule allows inbound HTTPS traffic from any Internet source to the subnet, which may be overly permissive. Option C is correct because the rule allows HTTPS from the Internet to the subnet 10.0.1.0/24, making the frontend accessible from anywhere, which is a security risk if not intended. Option A is wrong because the rule does allow Internet traffic. Option B is wrong because the rule is inbound, not outbound. Option D is wrong because the rule allows traffic on port 443.

Answer

The rule only allows traffic on port 443 from a specific IP range

Answer

The rule allows outbound traffic from the subnet to the Internet

Answer

The rule blocks all inbound traffic from the Internet

Question 10

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only approved applications can run on corporate devices. Which Intune feature should you configure?

Accepted Answer

AppLocker. Option B is correct because AppLocker allows you to create policies to control which apps can run. Option A is wrong because Windows Defender Firewall controls network traffic. Option C is wrong because BitLocker encrypts drives. Option D is wrong because Windows Information Protection prevents data leaks.

Answer

Windows Defender Firewall

Answer

BitLocker

Answer

Windows Information Protection

Question 11

You need to design a solution to protect Azure VMs from malware and vulnerabilities. Which Microsoft service should you use?

Accepted Answer

Microsoft Defender for Cloud. Option C is correct because Microsoft Defender for Cloud provides threat detection, vulnerability assessment, and antimalware for VMs. Option A is wrong because Microsoft Sentinel is a SIEM. Option B is wrong because Microsoft Intune is for device management. Option D is wrong because Microsoft Purview is for data governance.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 12

Your company uses Azure Firewall to filter outbound traffic from a virtual network. You need to allow only HTTP and HTTPS traffic to specific FQDNs, while blocking all other outbound traffic. Which Azure Firewall rule type should you use?

Accepted Answer

Application rule. Option D is correct because application rules allow filtering based on FQDNs for HTTP/HTTPS. Option A is wrong because network rules filter by IP/port, not FQDN. Option B is wrong because NAT rules only translate addresses. Option C is wrong because threat intelligence rules block known malicious IPs.

Answer

NAT rule

Answer

Threat intelligence rule

Answer

Network rule

Question 13

You are designing a secure hybrid network connectivity solution between an on-premises datacenter and Azure. The requirement is to have encrypted traffic and high availability. Which service should you use?

Accepted Answer

Azure VPN Gateway. Option C is correct because VPN Gateway provides encrypted site-to-site VPN with active-active configuration for high availability. Option A is wrong because ExpressRoute offers private connectivity but encryption is optional. Option B is wrong because Azure Bastion is for RDP/SSH access. Option D is wrong because Azure Front Door is a global load balancer.

Answer

Azure Front Door

Answer

Azure ExpressRoute

Answer

Azure Bastion

Question 14

You need to ensure that Azure SQL Database always encrypts data at rest and in transit. Which features should you enable?

Accepted Answer

Transparent Data Encryption (TDE) and enforce TLS connections. Option B is correct because Transparent Data Encryption (TDE) encrypts data at rest, and enforcing TLS encrypts data in transit. Option A is wrong because Always Encrypted encrypts specific columns, not the entire database. Option C is wrong because Azure Defender for SQL provides threat detection. Option D is wrong because firewall rules control access.

Answer

Firewall rules and Azure Active Directory authentication

Answer

Always Encrypted and firewall rules

Answer

Azure Defender for SQL and vulnerability assessment

Question 15

Your organization uses Microsoft Sentinel for security operations. You need to design a solution to automatically respond to a confirmed compromise of a domain controller by isolating the affected VM. Which automation feature should you use?

Accepted Answer

Automation rules with a playbook. Option A is correct because automation rules can trigger a playbook that runs a script to isolate the VM. Option B is wrong because analytics rules generate alerts but do not respond. Option C is wrong because workbooks visualize data. Option D is wrong because hunting queries are for proactive searches.

Answer

Analytics rules with incident creation

Answer

Hunting queries

Answer

Workbooks

Question 16

Your organization uses Microsoft Sentinel to monitor hybrid workloads. You need to design a solution to detect lateral movement attempts using pass-the-hash attacks. Which data source should you prioritize for ingestion?

Accepted Answer

Windows Security Events (Event ID 4624). Option B is correct because Windows Security Event ID 4624 (successful logon) with LogonType 3 (network) and hashed credentials is key for detecting pass-the-hash. Option A is wrong because Azure Activity Logs record control plane events, not authentication details. Option C is wrong because Sysmon Event ID 1 is process creation, not authentication. Option D is wrong because DNS logs may show network connections but not credential theft.

Answer

Sysmon Event ID 1 (Process creation)

Answer

DNS Query Logs

Answer

Azure Activity Logs

Question 17

Your company is designing a Zero Trust network for a hybrid workforce. Remote users connect via VPN to on-premises resources, while cloud apps use Microsoft Entra ID. You need to enforce conditional access based on device compliance and user risk. Which Microsoft security solution should you integrate with Entra ID to provide real-time device posture signals?

Accepted Answer

Microsoft Intune. Option C is correct because Microsoft Intune provides device compliance policies that integrate with Entra ID Conditional Access. Option A is wrong because Microsoft Defender for Cloud Apps is a CASB, not a device management solution. Option B is wrong because Microsoft Purview focuses on data governance. Option D is wrong because Microsoft Sentinel is a SIEM/SOAR, not a device management tool.

Answer

Microsoft Purview

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 18

You are designing a secure infrastructure for an e-commerce platform hosted on Azure. The platform must meet PCI DSS compliance. Which Azure service should you use to centrally manage and monitor security policies across subscriptions?

Accepted Answer

Azure Policy. Option A is correct because Azure Policy allows you to enforce compliance rules across subscriptions. Option B is wrong because Azure Blueprints is deprecated; Azure Policy is the current recommendation. Option C is wrong because Azure Firewall is a network security appliance, not a policy management tool. Option D is wrong because Azure Security Center is now part of Defender for Cloud, which uses policies but the core policy engine is Azure Policy.

Answer

Azure Firewall

Answer

Microsoft Defender for Cloud

Answer

Azure Blueprints

Question 19

A multinational corporation uses Microsoft Entra ID with hybrid identities. They need to design a solution that automatically remediates risky sign-ins without user intervention. Which feature should you enable?

Accepted Answer

Identity Protection with Conditional Access policies. Option B is correct because Entra ID Identity Protection with conditional access policies can block or require MFA automatically based on risk. Option A is wrong because PIM is for privileged identity management, not risk-based remediation. Option C is wrong because Entra ID Governance is for access reviews and entitlement management. Option D is wrong because Microsoft Defender for Identity is for on-premises identity protection, not automatic remediation.

Answer

Entra ID Governance (Access Reviews)

Answer

Privileged Identity Management (PIM)

Answer

Microsoft Defender for Identity

Question 20

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to design a solution that automatically creates an incident in Sentinel when a Defender XDR alert fires. Which integration should you configure?

Accepted Answer

Microsoft Defender XDR data connector in Sentinel. Option C is correct because the Microsoft Defender XDR connector in Sentinel allows alert streaming and incident creation. Option A is wrong because Microsoft Power Automate can be used but is not the primary integration. Option B is wrong because Logic Apps can automate but the connector is the standard method. Option D is wrong because Microsoft Graph API is programmatic but not the designed integration.

Answer

Azure Logic Apps with Defender XDR connector

Answer

Microsoft Power Automate flow triggered by Defender XDR alerts

Answer

Microsoft Graph API subscription to Defender XDR alerts