SC-100 Infrastructure Security 4 — Questions and Answers
Question 1: An architect needs to implement zero-trust network access for Azure workloads. Which principle should be applied to network segmentation?
- Allow all internal traffic by default
- Microsegmentation with least-privilege access controls (Correct answer)
- Perimeter-based firewall only
- Trust all traffic from private IP ranges
Correct answer: Microsegmentation with least-privilege access controls
Zero-trust microsegmentation enforces least-privilege access per workload, assuming breach and verifying every connection regardless of source.
Question 2: Which Azure feature allows administrators to require just-in-time (JIT) access approval before opening management ports on virtual machines?
- Azure Bastion
- Microsoft Defender for Cloud JIT VM access (Correct answer)
- Azure Firewall DNAT rules
- Network Watcher packet capture
Correct answer: Microsoft Defender for Cloud JIT VM access
Microsoft Defender for Cloud's JIT VM access temporarily opens specific management ports only when explicitly approved, reducing attack surface.
Question 3: A security architect wants to ensure all data at rest in Azure Blob Storage is encrypted with customer-managed keys. Where are these keys stored?
- Azure Key Vault (Correct answer)
- Azure Storage itself
- Azure Active Directory
- Azure Defender vault
Correct answer: Azure Key Vault
Customer-managed keys for Azure Storage encryption are stored and managed in Azure Key Vault, giving the customer full control over key lifecycle.
Question 4: An organization needs to evaluate the security posture of its Azure environment and receive a prioritized list of recommendations. Which tool provides a Secure Score?
- Azure Advisor
- Microsoft Defender for Cloud (Correct answer)
- Azure Sentinel
- Microsoft Secure Score in Defender 365
Correct answer: Microsoft Defender for Cloud
Microsoft Defender for Cloud provides a Secure Score that quantifies the security posture and prioritizes recommendations for Azure resources.
Question 5: A company is concerned about cryptojacking on their Azure virtual machines. Which Microsoft Defender plan detects this threat?
- Defender for DNS
- Defender for Servers (Correct answer)
- Defender for Key Vault
- Defender for Resource Manager
Correct answer: Defender for Servers
Microsoft Defender for Servers detects anomalous compute behavior including cryptomining/cryptojacking activity on Azure VMs.
Question 6: Which Azure networking feature provides URL-based routing, SSL termination, and WAF capabilities for web applications in a single solution?
- Azure Load Balancer Standard
- Azure Application Gateway with WAF (Correct answer)
- Azure Traffic Manager
- Azure Front Door Standard
Correct answer: Azure Application Gateway with WAF
Azure Application Gateway with WAF provides Layer 7 load balancing, URL-based routing, SSL offloading, and web application firewall in one regional service.
Question 7: An architect is designing security for an Azure-hosted API. Which service provides rate limiting, authentication, and threat protection specifically for APIs?
- Azure API Management with policies (Correct answer)
- Azure Firewall Premium
- Azure Application Gateway WAF only
- Azure Active Directory B2C
Correct answer: Azure API Management with policies
Azure API Management with security policies provides rate limiting, OAuth/JWT validation, IP filtering, and integration with Defender for APIs for comprehensive API security.
SC-100 Infrastructure Security 4
An architect needs to implement zero-trust network access for Azure workloads.
Which principle should be applied to network segmentation?