hardMultiple ChoiceObjective-mapped
SC-100 Practice Question: The security architect for a large financial…
You are the security architect for a large financial services company. The company has a hybrid environment with on-premises Active Directory, Azure AD, and multiple Azure subscriptions. They use Microsoft Sentinel as their SIEM and have deployed Microsoft Defender for Cloud to assess their cloud security posture. Recently, the security team discovered that a critical Azure SQL database was exposed to the internet with a firewall rule allowing 'AllowAllWindowsAzureIps'. This misconfiguration was not flagged by Defender for Cloud because the corresponding recommendation was disabled in the security policy. The company wants to prevent such misconfigurations in the future and ensure that all critical resources are covered by security recommendations. They also need to ensure that any changes to security policies are reviewed and approved. Which of the following actions should you recommend as the most comprehensive solution?
⚠ Common exam trap
The trap here is that candidates often focus on a single technical fix (like enabling a recommendation or setting an alert) rather than recognizing the need for a comprehensive governance solution that combines policy enforcement with a change management approval process to prevent and detect misconfigurations across all critical resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review and enable all relevant security recommendations in Defender for Cloud, and implement a change management process using Azure Policy and a custom workflow that requires approval before modifying security policies.
It addresses the root cause—disabled security recommendations—by enabling all relevant recommendations in Defender for Cloud, and it enforces a change management process using Azure Policy with a custom approval workflow. This ensures that any modifications to security policies are reviewed and approved, preventing future misconfigurations like the 'AllowAllWindowsAzureIps' rule from going unnoticed. The combination of policy enforcement and approval workflow provides a comprehensive, automated governance layer that covers both detection and prevention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Review and enable all relevant security recommendations in Defender for Cloud, and implement a change management process using Azure Policy and a custom workflow that requires approval before modifying security policies.
Why this is correct
Reviewing and enabling all relevant Defender for Cloud security recommendations establishes a comprehensive security baseline across the subscription, ensuring misconfigurations such as exposed SQL firewall rules are proactively identified and remediated. Pairing this with a change management process built on Azure Policy and a custom approval workflow enforces governance, so any modification to security policies requires audited, authorized action—directly addressing the root cause of disabled recommendations rather than reacting to individual incidents.
- ✗
Deploy Azure Monitor alerts on all SQL Server firewall rule changes and instruct the security team to manually review each change.
Why it's wrong here
Azure Monitor alerts on SQL Server firewall rule changes are inherently reactive: they notify security staff only after a change has already been made, and a manual review process is unscalable and prone to human oversight. This approach does nothing to prevent the initial misconfiguration or to identify why Defender for Cloud recommendations were disabled in the first place, leaving the underlying security posture weak even if some alert backlog is eventually triaged.
- ✗
Assign the Contributor role to the security team on the subscription so they can directly modify firewall rules if needed.
Why it's wrong here
Assigning Contributor role to the security team grants broad write access across all resources in the subscription—far beyond SQL firewall rules—violating least privilege and unnecessarily expanding the blast radius if those credentials are compromised. It also bypasses any need for approval or policy enforcement, meaning the team could directly alter firewall rules at will without a controlled process, which is exactly the kind of unmanaged change that led to the current vulnerability.
- ✗
Enable the specific recommendation for SQL Server firewall rules in Defender for Cloud and set up an automation rule to send alerts when the recommendation is triggered.
Why it's wrong here
Enabling only the specific SQL firewall rule recommendation and adding an automation rule merely narrows the focus to one symptom while leaving other disabled recommendations unaddressed, so the underlying policy drift persists. Furthermore, the automation rule triggers alerts after the condition is detected, which is reactive rather than preventative, and it does not enforce a change management workflow that would require approval before security policies are modified—so the same problem can easily recur.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.