SC-100 Infrastructure Security 5

Question 1

A company needs to secure administrative access to Azure VMs without exposing RDP or SSH ports to the internet. Which service provides browser-based secure access?

Accepted Answer

Azure Bastion

Answer

Azure Bastion provides secure RDP and SSH connectivity to VMs directly through the Azure portal without exposing management ports to the internet.

Question 2

An architect needs to enforce that Azure resources in a subscription can only be deployed to approved geographic regions. Which Azure construct achieves this?

Accepted Answer

Azure Policy with allowed locations definition

Answer

Azure Policy's built-in 'Allowed locations' definition denies deployment of resources to any region not explicitly listed in the policy parameters.

Question 3

When designing security for Azure Virtual Desktop, which control ensures that session host VMs are not directly accessible from the internet?

Accepted Answer

NSG with no inbound internet rules and RDP Shortpath over private network

Answer

AVD session hosts should have NSGs blocking direct internet inbound access, with connections routed through AVD's reverse connect transport or RDP Shortpath over managed networks.

Question 4

A security architect needs to detect unauthorized changes to critical Azure resource configurations in real time. Which service provides this capability?

Accepted Answer

Azure Activity Log alerts via Azure Monitor

Answer

Azure Activity Log captures all control-plane operations, and Azure Monitor alert rules can trigger notifications when critical resource configurations are modified.

Question 5

Which Microsoft Defender for Cloud feature continuously assesses Azure resources against CIS, NIST, and PCI DSS benchmarks and reports compliance status?

Accepted Answer

Regulatory Compliance dashboard

Answer

The Regulatory Compliance dashboard in Defender for Cloud maps resource configurations to industry standards and shows pass/fail status per control.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Infrastructure Security 5