SC-100 Timed Practice Test 4 — 10 Questions

Question 1

Order the steps to configure Azure Key Vault firewall and virtual network service endpoints.

Question 2

A company is designing a secure hybrid network architecture. They have an on-premises network connected to Azure via ExpressRoute and a site-to-site VPN as backup. They want to ensure that traffic from Azure to on-premises always uses ExpressRoute when available, but automatically fails over to VPN if ExpressRoute goes down. Which configuration should they implement?

Accepted Answer

Configure BGP on both connections and assign a higher local preference (e.g., 200) to routes learned via ExpressRoute.. Option D is correct because BGP local preference is an attribute used to influence outbound traffic from an AS. By assigning a higher local preference (e.g., 200) to routes learned via ExpressRoute, Azure will prefer those routes over VPN routes (which default to local preference 100). This ensures that traffic from Azure to on-premises uses ExpressRoute when available, and automatically fails over to the VPN if the ExpressRoute BGP session drops, as the VPN routes will then be selected.

Answer

Configure the VPN to have a lower BGP weight than ExpressRoute.

Answer

Use both connections in active-active mode with BGP and rely on ECMP.

Answer

Disable BGP on the VPN connection and use static routes with a higher metric for the VPN.

Question 3

A company deploys a three-tier application with web servers, application servers, and database servers in a VNet. They need to ensure that web servers can only communicate with application servers on port 443, and application servers can only communicate with database servers on port 1433. Web servers should not be able to communicate with database servers. What is the most secure and efficient way to implement this?

Accepted Answer

Place each tier in a separate subnet, and create NSGs on each subnet with appropriate inbound and outbound rules.. Option A is correct because placing each tier in a separate subnet and applying Network Security Groups (NSGs) with specific inbound and outbound rules provides network segmentation and granular traffic control. NSGs are stateful, so you can define rules that allow web servers to initiate outbound traffic to application servers on port 443 and application servers to initiate outbound traffic to database servers on port 1433, while implicitly denying all other cross-tier communication (including web-to-database). This approach is both secure and efficient as it uses native Azure constructs without additional cost or complexity.

Answer

Use Azure Firewall to inspect all traffic between tiers.

Answer

Use Application Security Groups (ASGs) to group VMs, but do not create NSGs.

Answer

Place all tiers in the same subnet, and use a single NSG with rules to allow and deny traffic.

Question 4

A company uses Azure Policy to enforce that all storage accounts must have HTTPS traffic only. They assign a built-in policy to audit this setting. A developer creates a new storage account with HTTP enabled, and the policy reports it as non-compliant. What should the company do to automatically remediate this violation?

Accepted Answer

Create a new policy assignment with a 'deployIfNotExists' effect that enables HTTPS-only.. Option D is correct because the 'deployIfNotExists' effect in Azure Policy can automatically remediate non-compliant resources by deploying a configuration (such as enabling HTTPS-only) when the policy detects a violation. This effect runs a remediation task that modifies the resource to meet the policy requirement, eliminating the need for manual intervention. In this scenario, it would automatically enable HTTPS traffic on the storage account, bringing it into compliance.

Answer

Enable Azure Security Center's just-in-time access for storage accounts.

Answer

Change the policy effect to 'Deny' to prevent creation of non-compliant storage accounts.

Answer

Ask the developer to manually enable HTTPS-only on the storage account.

Question 5

Which THREE components are required to implement a secure hybrid network with Azure using a site-to-site VPN?

Accepted Answer

VPN gateway (route-based). A route-based VPN gateway (option C) is required for site-to-site VPN connections because it uses dynamic routing (BGP) and supports IKEv2, enabling automatic failover and policy-based traffic selectors. This is essential for secure hybrid networking as it allows Azure to route traffic to on-premises networks via the VPN tunnel without static route limitations.

Answer

Public IP address for the VPN device

Answer

ExpressRoute circuit

Question 6

A company deploys Azure App Service with a custom domain and SSL certificate. They want to enforce HTTPS only. Which configuration setting should they enable?

Accepted Answer

HTTPS Only. The 'HTTPS Only' setting in Azure App Service enforces that all incoming requests are redirected from HTTP to HTTPS, ensuring encrypted communication. This is achieved by returning a 301 redirect for any HTTP request, which aligns with the requirement to enforce HTTPS only.

Answer

Client Certificates

Answer

Minimum TLS Version

Answer

Custom Domain

Question 7

A company uses Azure Storage for sensitive data. They need to ensure that data is encrypted at rest and that encryption keys are managed by the customer (Customer-Managed Keys). Which THREE actions are required?

Accepted Answer

Create an Azure Key Vault to store the customer-managed key. Option B is correct because customer-managed keys (CMK) for Azure Storage encryption must be stored in an Azure Key Vault, which provides a secure, centralized repository for managing cryptographic keys. Without a Key Vault, the customer cannot control or rotate the encryption keys used by Storage Service Encryption (SSE).

Answer

Enable double encryption

Answer

Enable Azure Information Protection

Question 8

A company is designing a microservices architecture on Azure Kubernetes Service (AKS). They need to secure communication between services using mutual TLS (mTLS). Which solution should they implement?

Accepted Answer

Istio service mesh. Istio service mesh is the correct solution because it provides a dedicated infrastructure layer for managing service-to-service communication, including automatic mutual TLS (mTLS) between microservices. Istio injects Envoy sidecar proxies into each pod, which handle encryption, authentication, and authorization without requiring application code changes. This enables zero-trust network security within the AKS cluster.

Answer

Azure Application Gateway

Answer

Azure Firewall

Answer

Azure API Management

Question 9

A company is designing a data classification strategy for their Azure environment. They need to identify sensitive data stored in Azure SQL Database. Which TWO solutions should they consider?

Accepted Answer

Azure SQL Data Discovery & Classification. Azure SQL Data Discovery & Classification is correct because it is a native feature of Azure SQL Database that automatically discovers, classifies, and labels sensitive columns (e.g., credit card numbers, PII) directly within the database engine. It provides a built-in dashboard for auditing and monitoring classification status, making it the primary tool for identifying sensitive data stored in Azure SQL Database.

Answer

Azure Information Protection

Answer

Azure Purview

Answer

Azure Policy

Question 10

A company uses Azure Policy to enforce compliance. They have a custom policy that denies creation of storage accounts without encryption enabled. A developer reports that they cannot create a storage account even though they specified encryption. What is the most likely cause?

Accepted Answer

The policy's 'then' block uses 'deny' but the condition logic evaluates the 'encryption' property incorrectly. Option C is correct because the most likely cause is that the policy's condition logic incorrectly evaluates the 'encryption' property. Azure Policy uses JSON-based condition expressions to check resource properties; if the condition does not match the actual property path (e.g., 'properties.encryption.enabled' vs. 'properties.encryption') or uses an incorrect operator, the deny effect will trigger even when encryption is specified. This is a common misconfiguration in custom policies.

Answer

The developer does not have 'Microsoft.Authorization/policyAssignments/write' permission

Answer

The policy effect is set to 'audit' instead of 'deny'

Answer

The policy is scoped to a management group that includes the developer's subscription