Design solutions that align with security best practices and priorities →hardMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
Contoso is a large enterprise with a complex Azure environment. They have multiple management groups, subscriptions, and a hub-spoke network topology. The security team wants to implement a consistent security baseline across all subscriptions using Azure Policy. They need to ensure that: 1) All resources must be deployed in approved regions only. 2) Network security groups must have specific rules to block high-risk ports. 3) All storage accounts must enforce HTTPS traffic. 4) The policies must be applied at the management group level to ensure inheritance. 5) Non-compliant resources must be automatically remediated where possible. What should you do?
⚠ Common exam trap
Many candidates confuse Azure Policy's 'deployIfNotExists' effect with manual remediation or third-party automation, leading candidates to choose options that lack native, automatic, and inherited policy enforcement at the management group level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create custom Azure Policy definitions for the required configurations (allowed locations, NSG rule blocking ports, storage HTTPS). Assign the policies at the root management group. Enable 'deployIfNotExists' effect for automatic remediation of non-compliant resources. Use Azure Policy remediation tasks to fix existing non-compliant resources.
It uses Azure Policy at the root management group to enforce inheritance across all subscriptions, with custom policy definitions for allowed locations, NSG rules blocking high-risk ports, and storage HTTPS. The 'deployIfNotExists' effect enables automatic remediation of non-compliant resources, and remediation tasks fix existing non-compliant resources, meeting all requirements without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Azure Policy Guest Configuration to enforce region and NSG rules. Assign policies at each subscription. Use Azure Automation runbooks for remediation.
Why it's wrong here
Azure Policy Guest Configuration is specifically designed for auditing and applying settings inside virtual machines (e.g., OS baseline, application config), not for enforcing resource-level attributes like allowed Azure regions, NSG rules on subnets/NICs, or storage HTTPS requirements. Furthermore, assigning policies per subscription scatters management and bypasses the centralized enforcement that a root management group assignment provides; Azure Automation runbooks would run only on a schedule or manually, offering reactive and inconsistent remediation rather than the continuous, event-driven repair that Azure Policy's DeployIfNotExists effect provides.
- ✓
Create custom Azure Policy definitions for the required configurations (allowed locations, NSG rule blocking ports, storage HTTPS). Assign the policies at the root management group. Enable 'deployIfNotExists' effect for automatic remediation of non-compliant resources. Use Azure Policy remediation tasks to fix existing non-compliant resources.
Why this is correct
This is the correct approach because Azure Policy is the native, continuous compliance service for resource-level configurations. By creating custom policy definitions for allowed locations, NSG rules, and storage HTTPS and assigning them at the root management group, the policies inherit to all child subscriptions and resource groups, providing a single, central governance baseline. Enabling the DeployIfNotExists effect makes Azure Policy automatically deploy the required configuration (e.g., a compliant NSG or secure storage setting) whenever a non-compliant resource is created or updated, and remediation tasks then correct pre-existing non-compliant resources, closing the compliance gap without manual intervention.
- ✗
Use Azure Blueprints to define the environment. Include Azure Policy assignments in the blueprint. Assign blueprint to each management group. Remediate manually.
Why it's wrong here
Azure Blueprints is deprecated in favor of Azure Policy, template specs, and other native tools; while blueprints could package policy assignments, they are no longer a supported long-term governance solution. Moreover, assigning a blueprint per management group is redundant and misses the simpler pattern of assigning the underlying policies directly at the root management group, from which inheritance flows. Finally, manual remediation after blueprint assignment is inefficient and does not provide the automated, ongoing enforcement and repair that DeployIfNotExists with remediation tasks delivers, leaving the environment exposed to configuration drift.
- ✗
Create a custom script using Azure PowerShell to check compliance daily. Use Azure Logic Apps to send alerts for non-compliance. Have IT staff manually fix issues.
Why it's wrong here
A custom PowerShell script run daily creates only a point-in-time compliance snapshot and cannot guarantee continuous enforcement or prevent non-compliant configurations from being created between runs. Logic Apps alerts merely notify staff; they do not implement any technical control, and having IT staff manually fix issues is error-prone and does not scale across a large enterprise. This approach misses Azure Policy's native capabilities: declarative rules, automatic evaluation on resource creation/change, and integrated remediation actions that provide real-time drift detection and correction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.