hardMultiple ChoiceObjective-mapped
SC-100 Practice Question: The lead security architect for a multinational…
You are the lead security architect for a multinational corporation that recently completed a merger. The new entity, Contoso Ltd., has a complex Azure environment with over 200 subscriptions spread across multiple management groups. The company's security team has identified several critical issues: (1) many subscriptions have Azure Security Center's Secure Score below 30%, (2) there are numerous unmanaged VMs with public IP addresses, (3) there is no centralized logging for security events, and (4) identity management is fragmented with multiple Azure AD tenants. The CEO mandates a 'zero-trust' security posture within 12 months. You have a limited budget and must prioritize the most impactful actions. Which course of action should you take first?
⚠ Common exam trap
The trap here is that candidates often prioritize network controls (Azure Firewall, forced tunneling) or monitoring tools (Azure Sentinel) because they seem more directly related to 'security' or 'visibility,' but the SC-100 exam emphasizes that identity is the new perimeter in zero-trust, and without a unified identity plane, all other controls are undermined.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Consolidate all Azure AD tenants into a single tenant and establish a common identity baseline
Identity is the foundational control plane for zero-trust architecture. Without a unified identity baseline across a single Azure AD tenant, you cannot enforce consistent conditional access policies, least-privilege access, or authentication strength—making all other security controls ineffective. Consolidating tenants first directly addresses the fragmented identity management issue and enables centralized policy enforcement, which is the highest-impact, lowest-cost action to improve the security posture within 12 months.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement Azure Sentinel to centralize logs and create automated response playbooks
Why it's wrong here
Azure Sentinel centralization and automated playbooks improve visibility and incident response, but they operate post-event and assume consistent identities across the environment. Without first consolidating the fragmented tenant structure, Sentinel cannot enforce a unified conditional access policy, and detection coverage will be incomplete because each tenant generates separate, siloed logs with different trust attributes. The correct zero-trust sequence is to establish the identity plane first, then layer security analytics and orchestration on top.
- ✗
Deploy Azure Firewall and enforce forced tunneling for all VNets
Why it's wrong here
Deploying Azure Firewall with forced tunneling restricts all outbound VNet traffic through a central firewall, which is a classic network perimeter control. Zero-trust, however, explicitly discards the assumption that network location equals trust, and this move does nothing to reconcile the multiple identity directories that grant access to resources. Even with egress filtering, a user with privileged access in one tenant can still compromise assets, because the firewall cannot evaluate user risk or enforce MFA consistently across tenants.
- ✓
Consolidate all Azure AD tenants into a single tenant and establish a common identity baseline
Why this is correct
Consolidating all Azure AD tenants into a single tenant and establishing a common identity baseline is the correct first step because zero-trust hinges on a single authoritative identity directory to enforce consistent conditional access, MFA, and least-privilege controls. With one tenant, you can apply a standard set of security policies (e.g., require hybrid Azure AD join, enforce device compliance, restrict legacy auth) uniformly across all subscriptions and resources, eliminating policy drift between fragmented directories. This creates the identity plane from which all access decisions are derived, which is the only way to satisfy the 'verify explicitly' pillar at scale.
- ✗
Deploy Azure Policy to deny creation of VMs with public IPs and enforce NSGs
Why it's wrong here
Azure Policy to deny public IPs and enforce NSGs reduces the network attack surface, but it only addresses one symptom of the fragmented identity architecture and can break legitimate scenarios that require public endpoints. It also gives a false sense of security because a compromised private workload protected by an NSG can still be used as a pivot point, and the policy cannot enforce identity-based controls like MFA or conditional access across multiple tenants. The fundamental flaw is that it leaves each tenant's distinct identity universe intact, so access decisions remain inconsistent regardless of network restrictions.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.