Microsoft security solutions are the largest part of SC-900, worth 35-40% of the exam. This set focuses on the Azure side: the network services that protect infrastructure (Azure Firewall, Web Application Firewall, network security groups, and Azure Bastion), posture management with Microsoft Defender for Cloud, and detection and response with Microsoft Sentinel and Microsoft Defender XDR.
This is the seventh set in our SC-900 series (Questions 61-70), written for the skills outline that takes effect on October 21, 2026. Earlier sets covered DDoS Protection and Key Vault, so this one concentrates on the services you have not practiced yet. Every question is an original practice scenario, not a copy of a real exam item.
Answer each question first, then check the explanation. Many questions here hinge on which network layer a service works at.
Question 61: One Firewall for the Whole Network
Contoso has several Azure virtual networks connected in a hub-and-spoke design. It wants one central, stateful service that filters traffic between networks and to the internet, allows outbound access only to approved domain names, and blocks traffic to known malicious IP addresses. Which service fits?
A) A network security group on every subnet
B) Azure Web Application Firewall
C) Azure DDoS Protection
D) Azure Firewall
👁 Reveal Answer
Correct Answer: D
Explanation: Azure Firewall is a managed, cloud-based, stateful firewall service that you can deploy centrally, for example in a hub network. It supports rules based on fully qualified domain names (FQDNs) and threat intelligence-based filtering that can alert on or block traffic to known malicious IP addresses and domains. A filters by IP address, port, and protocol on a subnet or network interface, but it does not filter by domain name or use threat intelligence. B protects web applications from attacks such as SQL injection. C absorbs volumetric attacks; it does not control which destinations are allowed.
Reference: What is Azure Firewall?
Question 62: Protecting a Public Web App From Injection Attacks
A retailer’s public website runs behind Azure Application Gateway. Security testing found that attackers could try SQL injection and cross-site scripting against it. Which service should be enabled?
A) Azure Bastion
B) Azure Web Application Firewall (WAF) on Application Gateway
C) A network security group that blocks port 443
D) Microsoft Entra Conditional Access
👁 Reveal Answer
Correct Answer: B
Explanation: Azure Web Application Firewall provides centralized protection for web applications against common exploits and vulnerabilities, such as SQL injection and cross-site scripting. It can be deployed with Application Gateway, Azure Front Door, and Azure CDN. A provides secure remote access to virtual machines. C would block all HTTPS traffic, taking the site offline. D controls user sign-in, not malicious web requests.
Reference: What is Azure Web Application Firewall?
Question 63: Allowing Only HTTPS to the Web Tier
A three-tier application has a web subnet and a database subnet. The team wants to allow only HTTPS from the internet to the web subnet and allow the database subnet to accept traffic only from the web subnet on the database port. What is the simplest way to do this?
A) Deploy Azure Firewall Premium in every subnet
B) Turn on Microsoft Defender for Cloud
C) Network security groups with inbound rules on each subnet
D) Azure DDoS Protection on the virtual network
👁 Reveal Answer
Correct Answer: C
Explanation: A network security group (NSG) contains security rules that allow or deny inbound and outbound traffic based on source, destination, port, and protocol, and it can be associated with subnets or network interfaces. Two NSGs with simple inbound rules meet this requirement. A is a central firewall service, not something you place in every subnet, and it is far more than this scenario needs. B assesses and recommends but does not filter traffic. D protects against volumetric attacks, not unwanted ports.
Reference: Network security groups
Question 64: Managing VMs Without Public IP Addresses
Administrators need to connect to Azure virtual machines with RDP and SSH. Security does not allow public IP addresses on the VMs and does not want RDP or SSH ports open to the internet. Which service should they use?
A) Azure Bastion, which provides RDP and SSH connections over TLS from the Azure portal
B) A public load balancer that forwards port 3389
C) Azure Web Application Firewall
D) Microsoft Purview Audit
👁 Reveal Answer
Correct Answer: A
Explanation: Azure Bastion is a fully managed service that provides secure RDP and SSH access to virtual machines over TLS, directly from the Azure portal or a native client. The VMs do not need public IP addresses, agents, or special client software, and RDP and SSH ports are not exposed to the internet. B exposes exactly the port security wants to hide. C protects web applications, not administrator access. D records activity in Microsoft 365.
Reference: What is Azure Bastion?
Question 65: Keeping Development Away From Production
A company puts its production workloads in one Azure virtual network and its development workloads in another. A new engineer asks whether development VMs can reach production VMs by default. What is the correct answer?
A) Yes, all virtual networks in the same subscription can reach each other automatically
B) Yes, but only over port 443
C) No, but only because Azure Firewall blocks it by default
D) No, virtual networks are isolated from each other by default; connecting them requires something like virtual network peering or a VPN gateway
👁 Reveal Answer
Correct Answer: D
Explanation: Each Azure virtual network is its own isolated network. Resources in one virtual network cannot reach another unless you connect them, for example with virtual network peering or VPN gateways. That is why separate virtual networks and subnets are a basic way to segment workloads. A and B are wrong, because no connection exists by default. C gives the wrong reason; isolation does not depend on deploying Azure Firewall.
Reference: What is Azure Virtual Network?
Question 66: Seeing How an Attacker Could Reach Sensitive Data
Northwind already uses the free Foundational CSPM plan in Microsoft Defender for Cloud, which gives it a secure score and recommendations. Security leaders now want attack path analysis to see how an attacker could move from an exposed VM to a storage account with sensitive data. What do they need?
A) Nothing; attack path analysis is included in Foundational CSPM
B) Microsoft Purview Compliance Manager
C) The Defender CSPM plan, which adds attack path analysis, cloud security explorer, and risk prioritization
D) Azure DDoS Protection
👁 Reveal Answer
Correct Answer: C
Explanation: Defender for Cloud offers two cloud security posture management (CSPM) plans. Foundational CSPM is free and includes asset inventory, secure score, security recommendations, and the Microsoft cloud security benchmark. The paid Defender CSPM plan adds advanced features such as attack path analysis, risk hunting with cloud security explorer, risk prioritization, and agentless vulnerability scanning. A is wrong because attack path analysis is not in the free plan. B tracks regulatory compliance tasks in Microsoft 365. D is not a posture management tool.
Reference: Cloud security posture management (CSPM) in Defender for Cloud
Question 67: Where Do the Recommendations Come From?
Defender for Cloud shows a recommendation that storage accounts should restrict network access. A manager asks why it appeared and what fixing it will do. Which explanation is correct?
A) Defender for Cloud assessed the resources against a security standard, by default the Microsoft cloud security benchmark, and fixing the recommendation improves the secure score
B) The recommendation was written by a Microsoft engineer who reviewed the subscription manually
C) It is an incident created by Microsoft Sentinel, and fixing it closes the incident
D) It comes from Compliance Manager and raises the compliance score
👁 Reveal Answer
Correct Answer: A
Explanation: Defender for Cloud continuously assesses resources against security standards. With Foundational CSPM, the Microsoft cloud security benchmark (MCSB) is the default standard, and resources that do not meet its controls generate recommendations. Secure score is based on these recommendations, and a higher score indicates lower identified risk, so remediating improves the score. B is wrong because assessments are automatic. C confuses posture recommendations with security incidents. D mixes up Defender for Cloud with Microsoft Purview.
Reference: Cloud security posture management (CSPM) in Defender for Cloud
Question 68: Detecting Attacks on Running Workloads
A company’s posture looks good, but it also wants Defender for Cloud to raise security alerts when its servers, storage accounts, and databases are actively attacked, for example by suspicious logins or malware uploads. What should it enable?
A) Only the free Foundational CSPM plan
B) Cloud workload protection plans in Defender for Cloud, such as Defender for Servers, Defender for Storage, and Defender for Databases
C) A Microsoft Purview retention policy
D) Azure Bastion
👁 Reveal Answer
Correct Answer: B
Explanation: Defender for Cloud combines posture management (CSPM) with cloud workload protection. The workload protection plans, such as Defender for Servers, Defender for Storage, and Defender for Databases, provide threat detection and generate security alerts for active attacks against those resources. A improves configuration but does not provide workload threat detection. C keeps or deletes content. D secures administrator access to VMs but does not detect attacks.
Reference: What is Microsoft Defender for Cloud?
Question 69: Responding Automatically to an Incident
A security operations team collects logs from firewalls, servers, and Microsoft 365 in Microsoft Sentinel. When an incident shows a compromised user, the team wants Sentinel to disable the account and notify the on-call engineer automatically. Which capability provides this?
A) A data connector
B) A workbook
C) Secure score
D) An automation rule that runs a playbook
👁 Reveal Answer
Correct Answer: D
Explanation: Microsoft Sentinel is a cloud-native SIEM and SOAR solution. Data connectors bring logs in, analytics rules detect threats and create incidents, and automation rules and playbooks (built on Azure Logic Apps) respond automatically, for example by disabling a user and sending a notification. That automated response is the SOAR part. A only ingests data. B visualizes data. C is a posture measure from Defender for Cloud and Microsoft 365, not a response action.
Reference: What is Microsoft Sentinel?
Question 70: Which Vulnerabilities Should We Fix First?
An IT team manages thousands of Windows and macOS devices onboarded to Microsoft Defender for Endpoint. It wants a continuous, prioritized view of software vulnerabilities and misconfigurations across those devices, with remediation guidance. Which Microsoft Defender XDR service fits?
A) Microsoft Defender for Office 365
B) Microsoft Defender Vulnerability Management
C) Microsoft Defender for Identity
D) Microsoft Defender for Cloud Apps
👁 Reveal Answer
Correct Answer: B
Explanation: Microsoft Defender Vulnerability Management provides asset visibility, continuous assessment of vulnerabilities and misconfigurations, risk-based prioritization, and remediation tracking across devices. A protects email and collaboration tools from threats such as phishing. C detects identity attacks against on-premises Active Directory. D discovers and controls cloud (SaaS) app usage. All of these come together in the Microsoft Defender portal.
Reference: Microsoft Defender Vulnerability Management
Study Tips for Azure Security and Security Operations
- Know the layer. NSGs filter by IP, port, and protocol. Azure Firewall adds central, stateful rules with domain names and threat intelligence. WAF protects web apps at the application layer.
- Bastion means no public IPs. It is the answer whenever admins need RDP or SSH without exposing VMs.
- Posture vs protection. CSPM finds weak configurations; workload protection plans detect active attacks.
- Free vs paid CSPM. Secure score and recommendations are free. Attack path analysis and cloud security explorer need Defender CSPM.
- SIEM plus SOAR. Sentinel collects and detects (SIEM) and responds with playbooks (SOAR).
Keep Practicing for SC-900
Review the security products in SC-900 Questions 21-30 and compliance in Questions 51-60. The official SC-900 study guide lists every skill measured.