SC-100 Infrastructure Security 4

Question 1

An architect needs to implement zero-trust network access for Azure workloads. Which principle should be applied to network segmentation?

Accepted Answer

Microsegmentation with least-privilege access controls

Answer

Zero-trust microsegmentation enforces least-privilege access per workload, assuming breach and verifying every connection regardless of source.

Question 2

Which Azure feature allows administrators to require just-in-time (JIT) access approval before opening management ports on virtual machines?

Accepted Answer

Microsoft Defender for Cloud JIT VM access

Answer

Microsoft Defender for Cloud's JIT VM access temporarily opens specific management ports only when explicitly approved, reducing attack surface.

Question 3

A security architect wants to ensure all data at rest in Azure Blob Storage is encrypted with customer-managed keys. Where are these keys stored?

Accepted Answer

Azure Key Vault

Answer

Customer-managed keys for Azure Storage encryption are stored and managed in Azure Key Vault, giving the customer full control over key lifecycle.

Question 4

An organization needs to evaluate the security posture of its Azure environment and receive a prioritized list of recommendations. Which tool provides a Secure Score?

Accepted Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Cloud provides a Secure Score that quantifies the security posture and prioritizes recommendations for Azure resources.

Question 5

A company is concerned about cryptojacking on their Azure virtual machines. Which Microsoft Defender plan detects this threat?

Accepted Answer

Defender for Servers

Answer

Microsoft Defender for Servers detects anomalous compute behavior including cryptomining/cryptojacking activity on Azure VMs.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Infrastructure Security 4