A company wants to isolate development and production environments in Azure. They plan to use separate virtual networks and want to ensure no traffic flows between them by default. What should they do?

Use Azure Firewall to block all traffic

Create one virtual network with two subnets

Use Azure Bastion to separate environments

Create two virtual networks and do not peer them

How can you manage Azure Firewall rules centrally across multiple firewalls?

By configuring each firewall individually through its own settings

By using Azure Firewall policies that can be associated with multiple firewalls

By using Azure DNS to control traffic routing

By using Azure Security Center to automatically generate rules

Your organization runs a web application on Azure App Service. Security requirements include blocking cross-site scripting (XSS) attacks and customizing rules based on application-specific traffic patterns. What should you implement?

Azure Firewall with application rules

Azure Web Application Firewall (WAF) with custom rules

Network Security Groups with inbound rules

What is the primary purpose of Azure Bastion?

To provide secure RDP and SSH connectivity to virtual machines without exposing them to the public internet

To filter network traffic at the subnet level

To load balance traffic between virtual machines

To encrypt data at rest in virtual machines

What is the primary purpose of Azure DDoS Protection?

To protect applications from distributed denial-of-service attacks

To block malicious IP addresses at the network firewall

To filter traffic based on application-layer rules

To encrypt data in transit between clients and Azure services

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 3Objective 1

Describe Core Infrastructure Security Services in Azure SC-900 Practice Questions (Page 9)

Part of the Describe the capabilities of Microsoft security solutions domain, which accounts for 35–40% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~7–12 in this domain), expect 2–3 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

12concepts

35–40%of the exam

12 Concepts in This Objective

Azure DDoS Protection Overview
Azure DDoS Protection Tiers
Azure Firewall Functionality
Azure Firewall Policy Management
Azure Web Application Firewall (WAF) Features
Azure WAF Deployment
Azure Virtual Networks Segmentation
Network Security Groups (NSGs) Function
NSG Rule Configuration
Azure Bastion Service
Azure Key Vault Overview
Azure Key Vault Integration

Questions 41–45

41application · medium
A company wants to isolate development and production environments in Azure. They plan to use separate virtual networks and want to ensure no traffic flows between them by default. What should they do?
Select an answer first
42foundation · easy
How can you manage Azure Firewall rules centrally across multiple firewalls?
Select an answer first
43application · medium
Your organization runs a web application on Azure App Service. Security requirements include blocking cross-site scripting (XSS) attacks and customizing rules based on application-specific traffic patterns. What should you implement?
Select an answer first
44foundation · easy
What is the primary purpose of Azure Bastion?
Select an answer first
45foundation · easy
What is the primary purpose of Azure DDoS Protection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.