SC-100 Design a Zero Trust strategy and architecture — 20 Questions

Question 1

A company is designing a Zero Trust network strategy. They want to ensure that all network traffic between on-premises and Azure is inspected and logged, regardless of source or destination. Which Azure service should they use to achieve this?

Accepted Answer

Azure Firewall. Azure Firewall is a managed, cloud-based network security service that provides inbound and outbound traffic inspection and logging for all traffic between on-premises networks and Azure, regardless of source or destination. It supports application and network-level filtering, threat intelligence-based filtering, and integrates with Azure Monitor for comprehensive logging, making it the correct choice for a Zero Trust network strategy that requires full traffic inspection and logging.

Answer

Azure Front Door

Answer

Azure Bastion

Answer

Azure DDoS Protection

Question 2

An organization is implementing a Zero Trust identity strategy. They have a mix of on-premises Active Directory and Azure AD. They want to enforce conditional access policies that require device compliance for accessing sensitive apps. However, some users report that their devices are not being evaluated for compliance even though they are enrolled in Microsoft Intune. What should the organization check first?

Accepted Answer

Verify that devices are registered in Azure AD. Device compliance evaluation in a hybrid identity environment requires that devices are registered in Azure AD (Azure AD Registration) so that Azure AD can associate the device identity with Intune compliance data. Even if a device is enrolled in Intune, without Azure AD registration, Conditional Access policies cannot evaluate its compliance status because the device identity is not recognized by Azure AD during authentication.

Answer

Ensure Intune compliance policies are assigned to the correct user groups

Answer

Confirm that devices are Azure AD Joined

Answer

Check if users have enabled multi-factor authentication

Question 3

A company is planning their Zero Trust data protection strategy. They want to classify and protect sensitive data stored in SharePoint Online. Which Microsoft tool should they use?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (formerly Microsoft Information Protection) is the correct tool because it provides integrated classification, labeling, and protection for sensitive data across Microsoft 365 services, including SharePoint Online. It uses sensitivity labels that can automatically apply encryption, rights management, and visual markings (headers/footers) to documents based on policy conditions, directly supporting the Zero Trust principle of 'assume breach' by protecting data at rest and in transit.

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud Apps

Answer

Azure Policy

Question 4

A company is implementing a Zero Trust network strategy using Azure Virtual Network Manager (AVNM). They need to ensure that all traffic between virtual networks is encrypted and inspected by a firewall. Which configuration should they use?

Accepted Answer

Use a hub-and-spoke topology with a firewall appliance in the hub. In a Zero Trust network strategy, all traffic must be encrypted and inspected regardless of source. A hub-and-spoke topology with a firewall appliance in the hub forces all inter-VNet traffic through the firewall, enabling deep packet inspection and encryption enforcement. Azure Virtual Network Manager (AVNM) can deploy this topology and route traffic via the hub, ensuring no direct VNet-to-VNet communication bypasses inspection.

Answer

Enable VNet peering between all VNets and use network security groups

Answer

Use a mesh topology with direct connectivity between VNets

Answer

Configure service endpoints for each VNet

Question 5

A company is designing a Zero Trust security posture for their Azure environment. They need to assess and improve their security posture. Which TWO actions should they take? (Choose two.)

Accepted Answer

Use Azure Policy to enforce security configurations. Azure Policy enforces organizational standards and assesses compliance at scale, which is a core Zero Trust principle of continuous verification and policy-driven access control. By applying policies that enforce security configurations (e.g., requiring HTTPS, restricting public network access), the company can proactively prevent misconfigurations and maintain a consistent security baseline across their Azure environment.

Answer

Enable Azure Update Management for all VMs

Answer

Deploy Microsoft Entra Permissions Management

Answer

Use Microsoft Security Copilot to generate security policies

Question 6

A company is implementing a Zero Trust identity strategy. They want to ensure that only compliant and managed devices can access corporate resources. Which THREE components should they include in their solution? (Choose three.)

Accepted Answer

Microsoft Intune for device management and compliance policies. A is correct because Microsoft Intune provides device management and compliance policies that define the security posture required for managed devices, such as requiring encryption, a minimum OS version, or a specific patch level. These compliance policies are evaluated by Azure AD during authentication, ensuring only devices that meet the organization's security standards can access corporate resources.

Answer

Azure AD Application Proxy

Answer

Azure AD B2B collaboration

Question 7

Refer to the exhibit. You are reviewing a Conditional Access policy in Azure AD. The policy requires MFA and a compliant device for all users and all cloud apps. Some users report that they are able to access apps without being prompted for MFA even though their devices are compliant. What is the most likely reason?

Accepted Answer

The policy is set to 'Report-only' mode. Option B is correct because a Conditional Access policy set to 'Report-only' mode evaluates the policy and logs results but does not enforce any controls, such as requiring MFA or a compliant device. Users can access apps without MFA prompts because the policy is not actively blocking or challenging them, even if their devices are compliant. This mode is used for testing before enabling enforcement.

Answer

The policy does not include all cloud apps

Answer

The policy excludes specific locations

Answer

The policy does not include session controls to enforce MFA re-prompt

Question 8

A company, Fabrikam, has a hybrid identity environment with on-premises Active Directory synchronized to Azure AD using Azure AD Connect. They have implemented a Zero Trust strategy that includes requiring multi-factor authentication (MFA) for all users accessing cloud applications. They use Conditional Access policies to enforce MFA. Recently, they noticed that users who authenticate from the on-premises network are not being prompted for MFA when accessing cloud apps, even though the Conditional Access policy is configured to require MFA for all users. The network location is not excluded in the policy. The Conditional Access policy is enabled and in 'Enforce' mode. The users' devices are not domain-joined. What is the most likely reason for this behavior?

Accepted Answer

Users are using legacy authentication protocols that do not support MFA. The most likely reason is that users are using legacy authentication protocols (e.g., POP3, IMAP, SMTP, or older Office clients) that do not support modern authentication and thus cannot enforce MFA via Conditional Access. Even though the policy requires MFA, legacy protocols bypass the Conditional Access engine entirely, allowing authentication without MFA prompts.

Answer

Azure AD Connect is not configured for Pass-through Authentication

Answer

The Conditional Access policy does not include session controls

Answer

The Conditional Access policy is not targeting the correct user group

Question 9

Order the steps to implement a Microsoft Sentinel data connector for Azure Active Directory logs.

Question 10

Order the steps to implement Azure AD Privileged Identity Management (PIM) for a role.

Question 11

Match each Azure security capability to its primary purpose.

Question 12

Match each Azure security benchmark control to its category.