mediumMultiple ChoiceObjective-mapped
SC-100 Practice Question: Designing a defense-in-depth strategy for their…
A company is designing a defense-in-depth strategy for their Azure environment. They want to ensure that if a virtual machine is compromised, the attacker cannot move laterally to other VMs in the same virtual network. Which security control should they prioritize?
⚠ Common exam trap
Many exam-takers confuse network-level controls (NSGs) with identity or access controls (MFA, Bastion) or perimeter defenses (DDoS Protection), failing to recognize that lateral movement is a network traffic problem that requires explicit east-west traffic filtering.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement network segmentation using NSGs and application security groups
Network segmentation using NSGs and application security groups is the correct priority because it directly controls east-west traffic between VMs within the same virtual network. By defining explicit inbound and outbound rules that restrict communication to only necessary ports and protocols (e.g., TCP 443 for HTTPS), an attacker who compromises one VM cannot initiate lateral movement to other VMs, as the NSG will drop unauthorized traffic at the subnet or NIC level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Azure DDoS Protection on the virtual network
Why it's wrong here
Azure DDoS Protection defends public IP endpoints against volumetric, protocol, and resource-layer attacks (L3/L4) from the internet, but it inspects only inbound traffic toward protected resources. It does not examine east-west traffic between virtual machines, so after an attacker compromises one VM, they can pivot freely to other VMs over the internal network without triggering DDoS mitigation. Thus, DDoS Protection addresses availability and brute-force floods, not lateral movement.
- ✓
Implement network segmentation using NSGs and application security groups
Why this is correct
Implementing network segmentation with Network Security Groups (NSGs) and Application Security Groups (ASGs) explicitly controls east-west traffic by enforcing allow-listed rules based on workload roles, protocols, and ports. NSGs act as distributed firewalls at the subnet and NIC level, while ASGs simplify grouping VMs by function (e.g., web, app, data) so you can deny all traffic by default and permit only required inter-tier flows. This zero-trust network approach directly limits an attacker's ability to move laterally from a compromised VM to other resources, making it the correct defense-in-depth measure for this threat.
- ✗
Enable multi-factor authentication (MFA) for all admin accounts
Why it's wrong here
Multi-factor authentication (MFA) strengthens identity verification for the control plane, such as Azure portal, CLI, or management APIs, and reduces the risk of stolen credentials. However, lateral movement occurs on the data plane over the network between VMs, often using stolen keys or malware already running on a compromised host, none of which involve interactive logon sessions that MFA can challenge. Since MFA does not monitor or filter east-west traffic, it cannot prevent an attacker from pivoting between VMs after an initial compromise.
- ✗
Deploy Azure Bastion for secure remote access
Why it's wrong here
Azure Bastion provides secure, managed RDP/SSH access to virtual machines through the Azure backbone, eliminating public IP exposure for management ports. But Bastion only secures the inbound management path; it does not enforce any network segmentation or filtering of traffic between VMs. Once an attacker gains a foothold on a VM via an application vulnerability, Bastion cannot block their subsequent internal HTTP, database, or RDP connections to other VMs, so it fails to contain lateral movement.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.