SC-100 · topic practice

Design security solutions for infrastructure practice questions

Q: How should I use these Design security solutions for infrastructure practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Q: Can I practise just Design security solutions for infrastructure questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Design security solutions for infrastructure domain.

Practise Microsoft Cybersecurity Architect Design security solutions for infrastructure practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Design security solutions for infrastructure

Practice 10 questions Browse domain →

What the exam tests

What to know about Design security solutions for infrastructure

Design security solutions for infrastructure questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Design security solutions for infrastructure exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Design security solutions for infrastructure questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Design security solutions for infrastructure explanation →

Your organization uses Microsoft Sentinel to monitor hybrid workloads. You need to design a solution to detect lateral movement attempts from compromised on-premises servers to Azure VMs. Which data connector should you prioritize?

Trap 1: Syslog via AMA

Syslog focuses on Linux systems, not Windows.

Trap 2: Office 365 Logs

Office 365 Logs cover cloud app activity, not on-premises or VM authentication.

Trap 3: Azure Activity Log

Azure Activity Log provides resource management events, not OS-level authentication events.

Study all Design security solutions for infrastructure common traps →

A
Syslog via AMA
Why wrong: Syslog focuses on Linux systems, not Windows.
B
Office 365 Logs
Why wrong: Office 365 Logs cover cloud app activity, not on-premises or VM authentication.
C
Windows Security Events via AMA
Captures security events like logons, which are critical for lateral movement detection.
D
Azure Activity Log
Why wrong: Azure Activity Log provides resource management events, not OS-level authentication events.

Design security solutions for infrastructure practice questions

What to know about Design security solutions for infrastructure

Common Design security solutions for infrastructure exam traps

Design security solutions for infrastructure questions

Your organization uses Microsoft Sentinel to monitor hybrid workloads. You need to design a solution to detect lateral movement attempts from compromised on-premises servers to Azure VMs. Which data connector should you prioritize?

A company plans to use Microsoft Defender for Cloud to secure a multi-cloud environment including Azure, AWS, and GCP. What is the first step to enable multi-cloud visibility?

You are designing a secure DevOps pipeline using GitHub Advanced Security and Microsoft Defender for Cloud. The development team uses a mix of Python and JavaScript. Which tool should you integrate to detect secrets (e.g., API keys) committed to the repository?

Which TWO Azure policies should you assign to enforce secure configuration of Azure SQL Database? (Select two.)

Which THREE features of Microsoft Defender for Cloud help secure Azure Kubernetes Service (AKS) clusters? (Select three.)

Which TWO actions should you take to improve the security posture of an Azure subscription using Microsoft Defender for Cloud? (Select two.)

Refer to the exhibit. You are reviewing an Azure Policy definition. What does this policy accomplish?

Exhibit

Refer to the exhibit. You need to ensure that the storage account 'seccorpstorage' is only accessible from a specific Azure virtual network. What should you do?

Exhibit

Refer to the exhibit. You are deploying an ARM template for a network security group. What is the security implication of this configuration?

Exhibit

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only approved applications can run on corporate devices. Which Intune feature should you configure?

You need to design a solution to protect Azure VMs from malware and vulnerabilities. Which Microsoft service should you use?

Your company uses Azure Firewall to filter outbound traffic from a virtual network. You need to allow only HTTP and HTTPS traffic to specific FQDNs, while blocking all other outbound traffic. Which Azure Firewall rule type should you use?

You are designing a secure hybrid network connectivity solution between an on-premises datacenter and Azure. The requirement is to have encrypted traffic and high availability. Which service should you use?

You need to ensure that Azure SQL Database always encrypts data at rest and in transit. Which features should you enable?

Your organization uses Microsoft Sentinel for security operations. You need to design a solution to automatically respond to a confirmed compromise of a domain controller by isolating the affected VM. Which automation feature should you use?

Your organization uses Microsoft Sentinel to monitor hybrid workloads. You need to design a solution to detect lateral movement attempts using pass-the-hash attacks. Which data source should you prioritize for ingestion?

You are designing a secure infrastructure for an e-commerce platform hosted on Azure. The platform must meet PCI DSS compliance. Which Azure service should you use to centrally manage and monitor security policies across subscriptions?

A multinational corporation uses Microsoft Entra ID with hybrid identities. They need to design a solution that automatically remediates risky sign-ins without user intervention. Which feature should you enable?

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to design a solution that automatically creates an incident in Sentinel when a Defender XDR alert fires. Which integration should you configure?

Track your progress over time

Start a Design security solutions for infrastructure only practice session

Related SC-100 topic practice pages

Design solutions that align with security best practices and priorities practice questions

Design security operations, identity, and compliance capabilities practice questions

Design security solutions for infrastructure practice questions

Design a Zero Trust strategy and architecture practice questions

Design security solutions for applications and data practice questions

Evaluate GRC and security operations strategies practice questions

Design security for infrastructure practice questions

Design a strategy for data and applications practice questions

Recommend security best practices and priorities practice questions

SC-100 fundamentals practice questions

SC-100 scenario practice questions

SC-100 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid