SC-100 Timed Practice Test 5 — 10 Questions

Question 1

A company uses Azure Key Vault to store secrets for their applications. They want to ensure that secrets can be automatically rotated when they are close to expiration. Which solution should they implement?

Accepted Answer

Use Key Vault event grid subscription to trigger an Azure Function for rotation. Option C is correct because Azure Key Vault can emit events via Event Grid when a secret is near expiration, and an Azure Function subscribed to that event can perform the rotation logic immediately. This event-driven approach ensures near-real-time rotation without polling, aligning with the requirement for automatic rotation close to expiration.

Answer

Use Azure DevOps release pipeline to rotate secrets

Answer

Use Azure Automation with a schedule to check expiration and rotate

Answer

Use Azure Logic Apps with a recurrence trigger to rotate secrets

Question 2

A company is migrating on-premises applications to Azure. They need to ensure that applications can use their existing Active Directory credentials for authentication. Which Azure service should they use?

Accepted Answer

Azure AD Domain Services. Azure AD Domain Services (Azure AD DS) provides managed domain services such as domain join, group policy, and Kerberos/NTLM authentication. This allows legacy on-premises applications that rely on Active Directory credentials to authenticate without needing to deploy and manage domain controllers in Azure. It bridges the gap by synchronizing identities from Azure AD and exposing traditional AD features over a virtual network.

Answer

Azure Active Directory

Answer

Azure AD Connect

Answer

Azure AD B2C

Question 3

A company wants to protect their Azure App Service web application from common web vulnerabilities like SQL injection and XSS. Which Azure service should they enable?

Accepted Answer

Azure Web Application Firewall (WAF) on Application Gateway. Azure Web Application Firewall (WAF) on Application Gateway is the correct choice because it provides centralized, inbound protection for web applications against common exploits such as SQL injection and cross-site scripting (XSS). WAF inspects HTTP/HTTPS traffic at the application layer (Layer 7) using OWASP Core Rule Sets (CRS) to block malicious payloads before they reach the App Service. This service is specifically designed to defend web workloads, unlike network-layer or generic firewall solutions.

Answer

Azure DDoS Protection

Answer

Azure Firewall

Answer

Azure Front Door with WAF

Question 4

A company is moving to a zero-trust security model. Which principle is most important for securing network traffic?

Accepted Answer

Verify explicitly every access request. In a zero-trust model, the principle of 'verify explicitly' means every access request—regardless of source—must be authenticated, authorized, and encrypted before being allowed. This eliminates implicit trust based on network location, which is the core shift from traditional perimeter-based security.

Answer

Rely on perimeter firewalls to block threats

Answer

Trust all traffic within the corporate network

Answer

Allow all traffic and monitor for anomalies

Question 5

A company is designing a secure DevOps pipeline for deploying Azure App Service applications. They need to ensure that secrets are not exposed in source code. Which TWO practices should they implement?

Accepted Answer

Use Azure Key Vault references in App Service application settings. Option A is correct because Azure Key Vault references allow App Service to securely retrieve secrets (e.g., connection strings, API keys) at runtime without storing them in source code or configuration files. The reference syntax @Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/mysecret/) is resolved by the App Service platform, ensuring secrets are never exposed in the repository or build artifacts.

Answer

Implement Git pre-commit hooks to scan for secrets

Answer

Store secrets in Azure DevOps library variable groups

Answer

Use Azure Policy to audit for secret exposure

Question 6

A company is planning a migration to Azure and wants to ensure that their security operations center (SOC) has visibility into all Azure resources. They need to collect security logs from multiple subscriptions into a central workspace. Which Azure service should they use?

Accepted Answer

Azure Sentinel. Azure Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) solution designed to ingest security logs from multiple Azure subscriptions, on-premises sources, and third-party clouds into a single central workspace. It provides the SOC with unified visibility, threat detection, and incident response across all Azure resources, meeting the requirement for centralized security log collection.

Answer

Azure Security Center

Answer

Azure Policy

Answer

Azure Monitor

Question 7

Refer to the exhibit. The ContosoPlatform management group has an Azure Policy assignment that denies all deployments without encryption. The App1 subscription contains a storage account that was created without encryption. Why is the storage account still non-compliant?

Accepted Answer

The storage account is in App1 subscription, which is under ContosoApplication, not ContosoPlatform. Option A is correct because Azure Policy inheritance only applies to direct child management groups and subscriptions. The App1 subscription is a direct child of the ContosoApplication management group, not ContosoPlatform. Since the policy denying deployments without encryption is assigned at ContosoPlatform, it does not inherit to App1 because App1 is not a direct descendant of ContosoPlatform. The storage account was created without encryption and is not subject to the policy, so it remains non-compliant.

Answer

The policy is assigned at ContosoPlatform, but App1 is not a direct child

Answer

The policy is assigned at ContosoRoot, but ContosoPlatform overrides it

Answer

Azure Policy does not inherit from parent management groups

Question 8

A company uses Azure Security Center and Azure Sentinel. They want to prioritize remediation of vulnerabilities based on risk. Which metric should they use to rank vulnerabilities?

Accepted Answer

Azure Secure Score impact. Azure Secure Score impact is the correct metric because it directly reflects the risk-based prioritization of security recommendations within Azure Security Center. Each recommendation has a Secure Score impact value that indicates how much your overall security posture improves when remediated, allowing you to prioritize actions that reduce the most risk. This aligns with the scenario's goal of ranking vulnerabilities by risk, as Secure Score impact is calculated using factors like exploitability, threat intelligence, and potential business impact.

Answer

Common Vulnerability Scoring System (CVSS) score

Answer

Compliance status from Azure Policy

Answer

Number of security alerts triggered

Question 9

Which TWO of the following are best practices for securing Azure Kubernetes Service (AKS)?

Accepted Answer

Use Azure AD integration for authentication. Azure AD integration for AKS enables role-based access control (RBAC) using Azure AD identities, allowing fine-grained permissions for cluster operations. This eliminates the need for shared static credentials and supports conditional access policies, multi-factor authentication, and audit logging via Azure AD sign-in logs. It is a foundational security best practice for identity management in Kubernetes clusters.

Answer

Deploy all applications in the default namespace

Answer

Use service principals instead of managed identities for pod identity

Answer

Enable SSH access to all worker nodes for troubleshooting

Question 10

A company is implementing a cloud security governance strategy. They need to ensure that all Azure resources are compliant with internal security policies before deployment. Which approach should they use?

Accepted Answer

Assign Azure Policy definitions with 'deny' effect at the subscription scope. Azure Policy with the 'deny' effect is the correct approach because it proactively prevents the deployment of any resource that violates defined security policies at the subscription scope. This ensures compliance before deployment by evaluating the resource against policy rules during the creation or update operation, blocking the request if non-compliant. Unlike reactive measures, this enforces governance at the point of deployment without requiring post-deployment remediation.

Answer

Configure Azure Firewall to block non-compliant resources

Answer

Deploy resources using Azure Blueprints

Answer

Use Azure DevOps pipelines with manual approval gates