What is the primary purpose of Azure Virtual Networks (VNets) in terms of security?

To provide a public IP address for every virtual machine

To encrypt all data stored in Azure

To provide network segmentation and isolation for Azure resources

To manage user access to Azure resources

A company stores application secrets in Azure Key Vault. They want to ensure that only a specific Azure AD application can read a particular secret, and they want to audit all access to the secret. What should they do?

Use Azure Bastion to access Key Vault

Use Azure DDoS Protection to protect Key Vault

Configure Key Vault access policy for the Azure AD application and enable diagnostic logs

Use Azure Firewall to restrict access to Key Vault

A company uses Azure Firewall to secure its network. The security team wants to allow outbound HTTPS traffic to a specific set of FQDNs, but block all other outbound traffic. They also want to ensure that the rules are applied consistently across multiple firewalls. What should they do?

Create an Azure Firewall Policy with an application rule collection that allows the FQDNs, and associate the policy with all firewalls

Create a custom route table to block all outbound traffic except to the FQDNs

Configure network security groups (NSGs) on each subnet to allow the FQDNs

Use Azure DDoS Protection to filter outbound traffic

A company has a virtual network with a subnet containing application servers and a subnet containing database servers. They need to ensure that only application servers can communicate with the database servers on port 1433. What should they configure?

Azure Bastion for database access

Network Security Group (NSG) rules on the database subnet

Azure DDoS Protection on the database subnet

Which Azure services can Azure WAF be deployed with?

Azure Kubernetes Service and Azure Container Instances

Azure Virtual Network and Azure VPN Gateway

Azure Storage and Azure SQL Database

Azure Front Door and Azure Application Gateway

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 3Objective 1

Describe Core Infrastructure Security Services in Azure SC-900 Practice Questions (Page 7)

Part of the Describe the capabilities of Microsoft security solutions domain, which accounts for 35–40% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~7–12 in this domain), expect 2–3 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

12concepts

35–40%of the exam

12 Concepts in This Objective

Azure DDoS Protection Overview
Azure DDoS Protection Tiers
Azure Firewall Functionality
Azure Firewall Policy Management
Azure Web Application Firewall (WAF) Features
Azure WAF Deployment
Azure Virtual Networks Segmentation
Network Security Groups (NSGs) Function
NSG Rule Configuration
Azure Bastion Service
Azure Key Vault Overview
Azure Key Vault Integration

Questions 31–35

31foundation · easy
What is the primary purpose of Azure Virtual Networks (VNets) in terms of security?
Select an answer first
32expert · hard
A company stores application secrets in Azure Key Vault. They want to ensure that only a specific Azure AD application can read a particular secret, and they want to audit all access to the secret. What should they do?
Select an answer first
33application · medium
A company uses Azure Firewall to secure its network. The security team wants to allow outbound HTTPS traffic to a specific set of FQDNs, but block all other outbound traffic. They also want to ensure that the rules are applied consistently across multiple firewalls. What should they do?
Select an answer first
34application · medium
A company has a virtual network with a subnet containing application servers and a subnet containing database servers. They need to ensure that only application servers can communicate with the database servers on port 1433. What should they configure?
Select an answer first
35foundation · easy
Which Azure services can Azure WAF be deployed with?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.