20+ practice questions focused on Design security solutions for infrastructure — one of the most tested topics on the Microsoft Cybersecurity Architect exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Design security solutions for infrastructure PracticeYour organization uses Microsoft Sentinel to monitor hybrid workloads. You need to design a solution to detect lateral movement attempts from compromised on-premises servers to Azure VMs. Which data connector should you prioritize?
Explanation: Windows Security Events via AMA. This connector captures security event logs (e.g., Event ID 4624 for logon, 4625 for failed logon) from Azure VMs, which are critical for detecting lateral movement. Option A (Syslog via AMA) is incorrect because it focuses on Linux logs, not Windows. Option B (Office 365 Logs) tracks cloud app activities, not OS-level events. Option D (Azure Activity Log) records resource-level operations, not security events on VMs.
A company plans to use Microsoft Defender for Cloud to secure a multi-cloud environment including Azure, AWS, and GCP. What is the first step to enable multi-cloud visibility?
Explanation: You must first onboard the AWS and GCP accounts into Defender for Cloud by connecting them via the native cloud connectors. Option A is wrong because enabling all Defender plans can be done after connecting the accounts, but it is not the first step. Option C is wrong because custom compliance policies are optional and not the first step. Option D is wrong because deploying Azure Arc agents is for on-premises or non-Azure servers, not for connecting cloud accounts.
You are designing a secure DevOps pipeline using GitHub Advanced Security and Microsoft Defender for Cloud. The development team uses a mix of Python and JavaScript. Which tool should you integrate to detect secrets (e.g., API keys) committed to the repository?
Explanation: GitHub secret scanning automatically detects secrets in repositories. Option B is wrong because CodeQL analyzes code for security vulnerabilities, not secrets. Option C is wrong because Dependabot focuses on dependency vulnerabilities. Option D is wrong because Defender for Cloud’s DevOps security posture management does not replace secret scanning.
Which THREE features of Microsoft Defender for Cloud help secure Azure Kubernetes Service (AKS) clusters? (Select three.)
Explanation: Azure Defender for Kubernetes (now part of Microsoft Defender for Cloud's cloud workload protection) provides cluster hardening recommendations by assessing AKS cluster configurations against industry benchmarks like CIS. It identifies misconfigurations such as overly permissive RBAC roles, insecure network policies, or unencrypted secrets, and offers remediation steps to reduce the attack surface.
Which TWO actions should you take to improve the security posture of an Azure subscription using Microsoft Defender for Cloud? (Select two.)
Explanation: Options B and C are correct. Enabling Azure Defender plans provides advanced threat protection across supported resource types, and implementing top security recommendations from the Secure Score directly improves your security posture. Option A is incorrect because assigning Azure Policy is a method to enforce compliance, but it's not an action specific to Defender for Cloud. Option D is incorrect because creating custom security policies is not a primary action for improving posture; Defender for Cloud already provides built-in policies. Option E is incorrect because deploying a vulnerability assessment solution applies only to VMs, not to all resources, and it is a more granular action rather than a broad security posture improvement step.
+15 more Design security solutions for infrastructure questions available
Practice all Design security solutions for infrastructure questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Design security solutions for infrastructure. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Design security solutions for infrastructure questions on the SC-100 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Design security solutions for infrastructure is tested as part of the Microsoft Cybersecurity Architect blueprint. Practicing with targeted Design security solutions for infrastructure questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free SC-100 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Design security solutions for infrastructure is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Design security solutions for infrastructure practice session with instant scoring and detailed explanations.
Start Design security solutions for infrastructure Practice →