SC-100 Infrastructure Security 3 — Questions and Answers
Question 1: A company needs to connect its on-premises network to Azure with guaranteed bandwidth and a private connection, bypassing the public internet. Which service should be used?
- Azure VPN Gateway
- Azure ExpressRoute (Correct answer)
- Azure Virtual WAN
- Azure Private Link
Correct answer: Azure ExpressRoute
Azure ExpressRoute provides a private, dedicated connection between on-premises infrastructure and Azure datacenters without traversing the public internet.
Question 2: An architect is designing protection against volumetric DDoS attacks for a public-facing application hosted in Azure. Which solution provides adaptive tuning and real-time telemetry?
- Azure Firewall Premium
- Azure DDoS Protection Standard (Correct answer)
- Azure Application Gateway WAF
- Azure Front Door
Correct answer: Azure DDoS Protection Standard
Azure DDoS Protection Standard provides adaptive tuning, real-time attack telemetry, and post-attack analysis for Azure resources.
Question 3: Which approach should a cybersecurity architect recommend to restrict Azure PaaS service access to only specific virtual networks?
- Service Endpoints with service endpoint policies (Correct answer)
- Azure Private DNS zones
- NSG application security groups
- Azure AD Conditional Access
Correct answer: Service Endpoints with service endpoint policies
Service Endpoints with service endpoint policies restrict access to specific PaaS resources from designated virtual networks.
Question 4: A security architect needs to ensure that Azure SQL Database is accessible only through private IP addresses within a VNet. Which feature achieves this?
- Azure SQL firewall rules
- Azure Private Endpoint (Correct answer)
- VNet Service Endpoints
- Azure AD authentication only
Correct answer: Azure Private Endpoint
Azure Private Endpoint assigns a private IP address from your VNet to the SQL Database, making it accessible only over private connectivity.
Question 5: An organization running hybrid infrastructure wants to apply Azure Security Center recommendations to on-premises servers. Which agent enables this?
- Azure Monitor Agent
- Log Analytics Agent with Azure Arc (Correct answer)
- Azure Diagnostics Extension
- Microsoft Defender for Endpoint sensor only
Correct answer: Log Analytics Agent with Azure Arc
Azure Arc enables on-premises servers to be managed in Azure, and combined with the Log Analytics agent, enables Microsoft Defender for Cloud coverage.
Question 6: Which Azure Firewall Premium feature inspects encrypted HTTPS traffic to detect hidden malware and exploits?
- IDPS signatures
- TLS inspection (Correct answer)
- Web categories filtering
- FQDN filtering
Correct answer: TLS inspection
TLS inspection in Azure Firewall Premium decrypts, inspects, and re-encrypts HTTPS traffic to detect threats hidden within encrypted sessions.
Question 7: A cybersecurity architect is evaluating container security. Which Microsoft Defender for Cloud feature scans container images in Azure Container Registry for vulnerabilities?
- Defender for Servers
- Defender for Containers (Correct answer)
- Defender for App Service
- Defender for DNS
Correct answer: Defender for Containers
Microsoft Defender for Containers includes vulnerability scanning for images stored in Azure Container Registry, providing risk prioritization.
SC-100 Infrastructure Security 3
A company needs to connect its on-premises network to Azure with guaranteed bandwidth and a private connection, bypassing the public internet.
Which service should be used?