SC-100 Infrastructure Security 5 — Questions and Answers
Question 1: A company needs to secure administrative access to Azure VMs without exposing RDP or SSH ports to the internet. Which service provides browser-based secure access?
- Azure VPN Gateway point-to-site
- Azure Bastion (Correct answer)
- Network Watcher
- Azure AD Application Proxy
Correct answer: Azure Bastion
Azure Bastion provides secure RDP and SSH connectivity to VMs directly through the Azure portal without exposing management ports to the internet.
Question 2: An architect needs to enforce that Azure resources in a subscription can only be deployed to approved geographic regions. Which Azure construct achieves this?
- Resource locks
- Azure Policy with allowed locations definition (Correct answer)
- Management group RBAC
- Azure Blueprints only
Correct answer: Azure Policy with allowed locations definition
Azure Policy's built-in 'Allowed locations' definition denies deployment of resources to any region not explicitly listed in the policy parameters.
Question 3: When designing security for Azure Virtual Desktop, which control ensures that session host VMs are not directly accessible from the internet?
- NSG with no inbound internet rules and RDP Shortpath over private network (Correct answer)
- Azure Bastion on each session host
- Public IP with SSL certificate
- Azure VPN Gateway per user
Correct answer: NSG with no inbound internet rules and RDP Shortpath over private network
AVD session hosts should have NSGs blocking direct internet inbound access, with connections routed through AVD's reverse connect transport or RDP Shortpath over managed networks.
Question 4: A security architect needs to detect unauthorized changes to critical Azure resource configurations in real time. Which service provides this capability?
- Azure Activity Log alerts via Azure Monitor (Correct answer)
- Azure Advisor
- Microsoft Defender for DNS
- Azure Cost Management
Correct answer: Azure Activity Log alerts via Azure Monitor
Azure Activity Log captures all control-plane operations, and Azure Monitor alert rules can trigger notifications when critical resource configurations are modified.
Question 5: Which Microsoft Defender for Cloud feature continuously assesses Azure resources against CIS, NIST, and PCI DSS benchmarks and reports compliance status?
- Secure Score
- Regulatory Compliance dashboard (Correct answer)
- Workload protections
- Security alerts
Correct answer: Regulatory Compliance dashboard
The Regulatory Compliance dashboard in Defender for Cloud maps resource configurations to industry standards and shows pass/fail status per control.
Question 6: An organization needs to ensure that secrets used by Azure functions are never stored in application code or configuration files. What is the recommended approach?
- Store secrets in Azure Blob Storage with SAS tokens
- Use Azure Key Vault references with managed identity (Correct answer)
- Encrypt secrets in appsettings.json
- Use Azure DevOps variable groups only
Correct answer: Use Azure Key Vault references with managed identity
Azure Key Vault references combined with managed identity allow Azure Functions to retrieve secrets at runtime without storing them in code or configuration.
Question 7: A cybersecurity architect is reviewing the shared responsibility model for Azure IaaS. Which security responsibility remains solely with the customer?
- Physical datacenter security
- Hypervisor patching
- Guest OS patching and configuration (Correct answer)
- Network fabric management
Correct answer: Guest OS patching and configuration
In the IaaS model, Microsoft manages physical infrastructure and hypervisor, but guest OS patching, configuration, and application security are the customer's responsibility.
SC-100 Infrastructure Security 5
A company needs to secure administrative access to Azure VMs without exposing RDP or SSH ports to the internet.
Which service provides browser-based secure access?