SC-100 Design security solutions for infrastructure Practice Question
Exhibit
Get-AzKeyVaultManagedHsm -HsmName 'contoso-hsm' -ResourceGroupName 'RG1'
Refer to the exhibit. You run the PowerShell command to retrieve information about a Managed HSM in Azure. The output shows that the HSM is in 'Provisioned' state and has two security domains. What is the purpose of the security domains?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To back up and restore the HSM's key material and configuration.
Security domains in Azure Managed HSM are used to back up and restore the HSM's key material and configuration. A security domain is a specially encrypted blob containing the HSM's full key material and configuration, and it is the only way to restore an HSM to a new instance or recover from a total loss of the HSM. Options A, C, and D are incorrect because private endpoint connections, RBAC, and network/firewall rules are managed through Azure networking and Azure RBAC features, not through security domains.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To manage the HSM's private endpoint connections.
Why it's wrong here
Private endpoint connections are established through Azure Private Link and are configured in the HSM's virtual network settings or via the networking blade, not through the security domain. The security domain download is a cryptographic backup operation that protects the HSM's master key. Managing private endpoints involves creating and approving private endpoint connections, which is orthogonal to the security domain's disaster-recovery purpose.
- ✓
To back up and restore the HSM's key material and configuration.
Why this is correct
The security domain contains the encrypted material needed to reconstruct the HSM's master key, which in turn wraps all keys and protects the HSM's configuration. Downloading it creates a backup that, along with the quorum of security domain keys, can restore the HSM to a usable state after a disaster. This is why the security domain is essential for disaster recovery of the managed HSM.
- ✗
To enable role-based access control (RBAC) for the HSM.
Why it's wrong here
RBAC for the HSM is enabled by assigning roles to principals via the Access Control (IAM) pane or through role assignment commands, which govern permissions for management and data plane operations. The security domain download does not grant or modify role assignments; it only exports cryptographic material. Enabling RBAC is a distinct access-management task separate from the security domain's backup/restore function.
- ✗
To define the HSM's network access and firewall rules.
Why it's wrong here
Network and firewall rules are defined in the HSM's networking configuration, specifying allowed virtual networks, subnets, or IP ranges using service endpoints or private endpoints. The security domain operation does not change network access controls; it merely provides a cryptographic backup file. Defining these rules is a network administration task performed via the Networking settings or ARM templates, not via security domain download.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 605-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.