SC-100 Practice Questions

A Case Study of Aperture Dynamics

Company Background
Aperture Dynamics is a high-tech engineering firm that develops sensitive intellectual property (IP). They have a hybrid environment with a significant on-premises data center running VMware, and they are aggressively migrating workloads to Azure. Their security strategy is based on Zero Trust principles.

Current Environment
Their Azure environment consists of multiple subscriptions organized under management groups. They use Azure AD for identity, with Azure AD Connect syncing from their on-premises Active Directory. Production workloads run in isolated virtual networks. Developers are using Azure DevOps for their CI/CD pipelines. The security team uses Microsoft Sentinel for SIEM and Microsoft Defender for Cloud for posture management.

Requirements

1. Privileged Access: All administrative access to Azure infrastructure must be just-in-time (JIT) and require approval. This applies to both permanent and temporary administrative roles.
2. Data Protection: All sensitive IP stored in Azure Storage accounts must be protected from malicious activity, and access must be audited. The data must be classified, and policies must prevent its exfiltration.
3. DevSecOps: The CI/CD pipeline must incorporate security checks. Specifically, any Infrastructure as Code (IaC) templates (ARM/Bicep) must be scanned for security misconfigurations before deployment.
4. Network Security: The company wants to secure remote user access to the internet and Microsoft 365 services without backhauling traffic to the on-premises data center, following a Security Service Edge (SSE) model.

Problem Statement
The security architect needs to design solutions to meet these four key requirements. Which service should be used to meet the DevSecOps requirement of scanning IaC templates for misconfigurations before deployment?

A Case Study of Aperture Dynamics

Company Background
Aperture Dynamics is a high-tech engineering firm that develops sensitive intellectual property (IP). They have a hybrid environment with a significant on-premises data center running VMware, and they are aggressively migrating workloads to Azure. Their security strategy is based on Zero Trust principles.

Current Environment
Their Azure environment consists of multiple subscriptions organized under management groups. They use Azure AD for identity, with Azure AD Connect syncing from their on-premises Active Directory. Production workloads run in isolated virtual networks. Developers are using Azure DevOps for their CI/CD pipelines. The security team uses Microsoft Sentinel for SIEM and Microsoft Defender for Cloud for posture management.

Requirements

1. Privileged Access: All administrative access to Azure infrastructure must be just-in-time (JIT) and require approval. This applies to both permanent and temporary administrative roles.
2. Data Protection: All sensitive IP stored in Azure Storage accounts must be protected from malicious activity, and access must be audited. The data must be classified, and policies must prevent its exfiltration.
3. DevSecOps: The CI/CD pipeline must incorporate security checks. Specifically, any Infrastructure as Code (IaC) templates (ARM/Bicep) must be scanned for security misconfigurations before deployment.
4. Network Security: The company wants to secure remote user access to the internet and Microsoft 365 services without backhauling traffic to the on-premises data center, following a Security Service Edge (SSE) model.

Problem Statement
The security architect needs to design solutions to meet these four key requirements. Which service should be used to meet the network security requirement for implementing an SSE model for remote users?

True or False: The Microsoft Cybersecurity Reference Architectures (MCRA) provides a prescriptive, one-size-fits-all deployment guide that must be implemented exactly as documented to achieve a secure posture.

A government agency is required to comply with the NIST SP 800-53 regulatory standard. The security architect needs a tool to continuously assess the agency's Azure environment against this standard, provide a compliance score, and offer actionable recommendations for remediation. The solution must be a native Azure service. Which component of Microsoft Defender for Cloud should be used to meet this requirement?

A security architect at TerraLogix is reviewing the network design for their Azure environment, which uses a hub-and-spoke topology. The design is intended to force all traffic between spoke virtual networks to be inspected by an Azure Firewall in the hub VNet. However, testing reveals that VMs in Spoke A can communicate directly with VMs in Spoke B. The VNet peerings are configured correctly between the hub and each spoke, but not directly between spokes. What is the most likely misconfiguration causing this unintended traffic flow?

A financial services firm, QuantumLeap Financials, is designing a Zero Trust architecture for its hybrid environment. They have a critical on-premises Active Directory Domain Services (AD DS) infrastructure and a growing footprint in Azure. A key requirement is to protect privileged administrative accounts in AD DS from pass-the-hash and other credential theft attacks originating from compromised workstations. The security architect needs to recommend a solution that isolates administrative tasks from daily user activities like email and web browsing. Which solution best meets this requirement by implementing a tiered access model?

A global logistics company, TerraNova Logistics, is migrating its infrastructure to a multi-cloud environment, using Azure, AWS, and GCP. The CISO is concerned about inconsistent permission management and the risk of privilege escalation across the different cloud platforms. They need a unified solution to discover, remediate, and monitor permissions for all identities and resources across their entire multi-cloud estate. Which Microsoft solution is specifically designed to address this Cloud Infrastructure Entitlement Management (CIEM) challenge?

An e-commerce company is building a new application on Azure Kubernetes Service (AKS). As part of their DevSecOps pipeline, they need to ensure that only approved and vulnerability-scanned container images are deployed to their production AKS cluster. The security policy dictates that any attempt to deploy an image that has not passed a security scan or is from an untrusted registry must be blocked. Which combination of Azure services should be used to enforce this policy? (Select TWO)

A healthcare organization uses Azure to store patient records in Azure SQL Database and Azure Blob Storage. They need to design a security solution that meets the following requirements:

• Discover and classify sensitive patient data across all Azure data stores.
• Provide a unified view of data security posture and identify potential threats to the data.
• Detect anomalous activities, such as unusual data access or potential SQL injection attacks, against the data stores.

Which two Microsoft Defender plans should be central to this design? (Select TWO)

A manufacturing company, Aperture Dynamics, is implementing Microsoft Sentinel as its SIEM. They have a hybrid environment with on-premises servers, Azure VMs, and several Microsoft 365 services. The security operations team needs to automate the initial triage and response to common alerts, such as impossible travel alerts from Azure AD Identity Protection. The automation must post a message in a specific Microsoft Teams channel for the on-duty analyst, temporarily disable the user account, and create a high-priority ticket in ServiceNow. Which Microsoft Sentinel feature should be used to build this automated workflow?