SC-100 Infrastructure Security 2 — Questions and Answers
Question 1: An organization wants to prevent lateral movement between Azure virtual machines in the same subnet. Which feature should a cybersecurity architect recommend?
- Azure Firewall Premium
- Network Security Group (NSG) with intra-subnet rules (Correct answer)
- Azure DDoS Protection Standard
- Azure Bastion
Correct answer: Network Security Group (NSG) with intra-subnet rules
NSGs support intra-subnet rules that filter traffic between VMs within the same subnet, preventing lateral movement.
Question 2: A company needs to ensure that only approved VM images are deployed in Azure. Which Azure Policy effect should be used to block non-compliant deployments?
- Audit
- Deny (Correct answer)
- DeployIfNotExists
- Modify
Correct answer: Deny
The Deny effect blocks resource deployment that does not meet the policy conditions, preventing non-compliant VM images from being deployed.
Question 3: Which Azure service provides hardware-level isolation for single-tenant dedicated physical servers to meet strict compliance and regulatory requirements?
- Azure Dedicated Hosts (Correct answer)
- Azure Reserved Instances
- Azure Spot VMs
- Azure Confidential Computing
Correct answer: Azure Dedicated Hosts
Azure Dedicated Hosts provide physical servers dedicated to a single organization, ensuring hardware-level isolation for compliance requirements.
Question 4: An architect needs to secure Kubernetes workloads running in Azure Kubernetes Service (AKS). Which feature enforces pod security policies at the cluster level?
- Azure Policy Add-on for AKS (Correct answer)
- Azure Defender for Containers
- Kubernetes RBAC
- Azure Container Registry scanning
Correct answer: Azure Policy Add-on for AKS
The Azure Policy Add-on for AKS enforces built-in and custom policies on AKS clusters, including pod security standards.
Question 5: A security architect is designing hub-and-spoke network topology. Which component should be placed in the hub to centralize inspection of all inter-spoke traffic?
- Application Gateway
- Azure Firewall (Correct answer)
- Azure Load Balancer
- Traffic Manager
Correct answer: Azure Firewall
Azure Firewall in the hub VNet provides centralized inspection and policy enforcement for all traffic flowing between spoke networks.
Question 6: An organization wants to detect and respond to threats targeting Azure Storage accounts. Which Microsoft service provides this capability?
- Azure Monitor
- Microsoft Defender for Storage (Correct answer)
- Azure Sentinel only
- Azure Information Protection
Correct answer: Microsoft Defender for Storage
Microsoft Defender for Storage detects unusual and potentially harmful access patterns to storage accounts, including malware upload detection.
Question 7: When designing a secure landing zone, which Azure feature ensures that all resources within a management group inherit security baseline policies?
- Azure Blueprints artifacts
- Management Group Policy inheritance (Correct answer)
- Subscription-level RBAC
- Resource locks
Correct answer: Management Group Policy inheritance
Azure Policy assigned at the management group level is inherited by all child subscriptions and resource groups within that group.
SC-100 Infrastructure Security 2
An organization wants to prevent lateral movement between Azure virtual machines in the same subnet.
Which feature should a cybersecurity architect recommend?