SC-100 Infrastructure Security 2

Question 1

An organization wants to prevent lateral movement between Azure virtual machines in the same subnet. Which feature should a cybersecurity architect recommend?

Accepted Answer

Network Security Group (NSG) with intra-subnet rules

Answer

NSGs support intra-subnet rules that filter traffic between VMs within the same subnet, preventing lateral movement.

Question 2

A company needs to ensure that only approved VM images are deployed in Azure. Which Azure Policy effect should be used to block non-compliant deployments?

Accepted Answer

Deny

Answer

The Deny effect blocks resource deployment that does not meet the policy conditions, preventing non-compliant VM images from being deployed.

Question 3

Which Azure service provides hardware-level isolation for single-tenant dedicated physical servers to meet strict compliance and regulatory requirements?

Accepted Answer

Azure Dedicated Hosts

Answer

Azure Dedicated Hosts provide physical servers dedicated to a single organization, ensuring hardware-level isolation for compliance requirements.

Question 4

An architect needs to secure Kubernetes workloads running in Azure Kubernetes Service (AKS). Which feature enforces pod security policies at the cluster level?

Accepted Answer

Azure Policy Add-on for AKS

Answer

The Azure Policy Add-on for AKS enforces built-in and custom policies on AKS clusters, including pod security standards.

Question 5

A security architect is designing hub-and-spoke network topology. Which component should be placed in the hub to centralize inspection of all inter-spoke traffic?

Accepted Answer

Azure Firewall

Answer

Azure Firewall in the hub VNet provides centralized inspection and policy enforcement for all traffic flowing between spoke networks.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Infrastructure Security 2