SC-100 · Domain 3: Design security solutions for infrastructure · 28% of the exam
Task 3.4: Evaluate solutions for network security and Security Service Edge (SSE)
Network designs against security requirements, Microsoft Entra Internet Access as a secure web gateway and for Microsoft services, and Microsoft Entra Private Access.
Security Service Edge: Microsoft Entra Internet Access and Private Access
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 1
A company with 8,000 hybrid workers wants gambling and newly registered domain categories blocked for everyone, and social media allowed only for the marketing group, whether people work at home or in the office. It doesn't want to backhaul traffic through an on-premises proxy. Which design should you evaluate as the secure web gateway?
AMicrosoft Entra Internet Access web filtering policies in security profiles, linked to Conditional Access
BAn on-premises proxy cluster that all remote workers reach through the corporate VPN
CNetwork security group rules on every Azure virtual network that hosts the company's workloads
DAzure Firewall Premium web categories in the hub virtual network
Show the answer and why
AMicrosoft Entra Internet Access web filtering policies in security profiles, linked to Conditional Access
Correct
Internet Access filters by web category and FQDN, and linking security profiles to Conditional Access makes the policies user- and context-aware.
BAn on-premises proxy cluster that all remote workers reach through the corporate VPN
Incorrect
This backhauls traffic, which the company wants to avoid.
CNetwork security group rules on every Azure virtual network that hosts the company's workloads
Incorrect
NSGs filter Azure network traffic by address and port, not users' web browsing by category.
DAzure Firewall Premium web categories in the hub virtual network
Incorrect
Azure Firewall filters traffic routed through Azure, not remote users' internet traffic.
Microsoft Entra Internet Access is the secure web gateway of Global Secure Access. Its web content filtering supports URL-based web category filtering, URL filtering and FQDN filtering. You create web filtering policies, group them in a security profile and link the profile to a Conditional Access policy, so filtering is user-aware and context-aware.
A company's VPN gives every remote employee network-level access to the whole datacenter. It wants to replace it so that finance staff reach only the finance apps, engineers only the build servers, each app with its own Conditional Access requirements such as MFA and compliant devices. Which design should you recommend?
AMicrosoft Entra Private Access Quick Access containing every datacenter subnet
BA second VPN concentrator for higher capacity
CMicrosoft Entra Private Access with per-app access, one Global Secure Access app per application group
DPublic IP addresses on each app protected by IP allow lists
Show the answer and why
AMicrosoft Entra Private Access Quick Access containing every datacenter subnet
Incorrect
Quick Access is one broad group of resources, much like the VPN it replaces, so it doesn't meet per-app requirements.
BA second VPN concentrator for higher capacity
Incorrect
More VPN capacity keeps network-level access.
CMicrosoft Entra Private Access with per-app access, one Global Secure Access app per application group
Correct
Per-app access defines subsets of private resources as separate apps with their own assignments and Conditional Access.
DPublic IP addresses on each app protected by IP allow lists
Incorrect
Exposing apps publicly increases risk and doesn't apply identity-based controls.
Microsoft Entra Private Access replaces VPNs for private apps. Quick Access is a primary group of FQDNs and IP addresses; per-app access with Global Secure Access apps lets you specify subsets of private resources as separate enterprise applications, each with its own user assignments and Conditional Access policies, brokered by private network connectors.
A defense contractor's data loss review shows employees uploading files to Microsoft 365 tenants owned by other organizations and to personal tenants, from corporate devices. The company wants corporate devices to sign in only to its own tenant and to approved partner tenants, without routing traffic through an on-premises proxy. What should the design use?
AInbound cross-tenant access settings that block other tenants' users
BA DLP policy that blocks uploads to SharePoint in the company's own tenant
CUniversal tenant restrictions through Global Secure Access, with tenant restrictions v2 policies
DBlocking the Microsoft 365 IP ranges on the corporate firewall
Show the answer and why
AInbound cross-tenant access settings that block other tenants' users
Incorrect
Inbound settings control who gets into your tenant, not where your users sign in.
BA DLP policy that blocks uploads to SharePoint in the company's own tenant
Incorrect
The problem is uploads to other tenants, which your tenant's DLP doesn't see.
CUniversal tenant restrictions through Global Secure Access, with tenant restrictions v2 policies
Correct
Universal tenant restrictions apply TRv2 to devices with the Global Secure Access client or on remote networks, without a company proxy.
DBlocking the Microsoft 365 IP ranges on the corporate firewall
Incorrect
That would block the company's own tenant too.
Universal Tenant Restrictions enhance tenant restrictions v2 by applying tenant restrictions policies to devices with the Global Secure Access client or on Global Secure Access remote networks, without steering traffic through a company-managed proxy. Users can sign in only to tenants and applications authorized in the TRv2 policy.
In a hub-and-spoke Azure network, compliance requires detecting known exploit and malware signatures in traffic between spokes and in outbound HTTPS traffic, which is mostly encrypted. Today, a Standard firewall in the hub filters by FQDN only. Which change aligns the design with the requirement?
AMove to Azure Firewall Premium with IDPS and TLS inspection for spoke traffic
BAdd more FQDN rules to the Standard firewall, including rules for each known malware distribution domain and its subdomains
CReplace the firewall with NSGs on each spoke subnet
DEnable DDoS Network Protection on the hub
Show the answer and why
AMove to Azure Firewall Premium with IDPS and TLS inspection for spoke traffic
Correct
Premium adds IDPS and TLS inspection, so encrypted traffic can be inspected for malicious activity.
BAdd more FQDN rules to the Standard firewall, including rules for each known malware distribution domain and its subdomains
Incorrect
FQDN rules don't inspect encrypted payloads for signatures.
CReplace the firewall with NSGs on each spoke subnet
Incorrect
NSGs filter by address and port and don't inspect traffic contents.
DEnable DDoS Network Protection on the hub
Incorrect
DDoS protection mitigates volumetric attacks; it doesn't inspect for exploits.
Azure Firewall Premium adds TLS inspection, which decrypts, inspects and re-encrypts traffic, and IDPS, which monitors network activity for malicious activity and can block it, plus URL filtering and web categories. In hub-and-spoke designs, user-defined routes send spoke traffic through the hub firewall.
Microsoft's Security Service Edge solution, Global Secure Access, brings together which two products?
AAzure Firewall and Azure DDoS Protection
BDefender for Endpoint and Intune
CAzure VPN Gateway and ExpressRoute
DMicrosoft Entra Internet Access and Microsoft Entra Private Access
Show the answer and why
AAzure Firewall and Azure DDoS Protection
Incorrect
Those are Azure network services.
BDefender for Endpoint and Intune
Incorrect
Those are endpoint products.
CAzure VPN Gateway and ExpressRoute
Incorrect
Those are hybrid connectivity services.
DMicrosoft Entra Internet Access and Microsoft Entra Private Access
Correct
Global Secure Access is the unifying umbrella for Internet Access and Private Access.
Global Secure Access is the unifying term for Microsoft Entra Internet Access and Microsoft Entra Private Access, Microsoft's Security Service Edge solution.
BA firewall rule on the service that allows traffic from the internet to reach it only on its own private IP address
CA VPN connection to an on-premises network
DA network interface with a private IP that connects privately to a service
Show the answer and why
AA public IP address reserved for a PaaS service
Incorrect
Private endpoints use private addresses.
BA firewall rule on the service that allows traffic from the internet to reach it only on its own private IP address
Incorrect
It isn't a firewall rule.
CA VPN connection to an on-premises network
Incorrect
That's a VPN gateway.
DA network interface with a private IP that connects privately to a service
Correct
Private endpoints bring a service into your virtual network over Private Link.
A private endpoint is a network interface that uses a private IP address from your virtual network and connects you privately and securely to a service powered by Azure Private Link.
Which feature lets you write network security group rules for "web servers" and "database servers" as groups of VMs instead of listing IP addresses?
AApplication security groups
BService tags in the NSG rules
CRoute tables
DPrivate DNS zones
Show the answer and why
AApplication security groups
Correct
ASGs group VMs so NSG rules can reference them.
BService tags in the NSG rules
Incorrect
Service tags represent Azure service address ranges, not your VMs.
CRoute tables
Incorrect
Route tables control routing, not rule targets.
DPrivate DNS zones
Incorrect
DNS zones resolve names.
Application security groups let you group virtual machines by application role and define network security policies based on those groups, instead of explicit IP addresses.
A team creates a new virtual network with a recent API version in 2026 and finds its new VMs can't reach the internet. Why?
AAzure blocks all outbound traffic from VMs permanently
BNew VNets default to private subnets, so VMs need explicit outbound access
CThe VMs need a public IP address on every network interface, because Azure policy requires it for outbound traffic
DOutbound traffic only works through ExpressRoute
Show the answer and why
AAzure blocks all outbound traffic from VMs permanently
Incorrect
Explicit outbound methods allow it.
BNew VNets default to private subnets, so VMs need explicit outbound access
Correct
For API versions after March 31, 2026, defaultOutboundAccess is false by default on new virtual networks.
CThe VMs need a public IP address on every network interface, because Azure policy requires it for outbound traffic
Incorrect
A NAT gateway or load balancer outbound rules also work.
DOutbound traffic only works through ExpressRoute
Incorrect
ExpressRoute isn't required for internet access.
For the API version released after March 31, 2026, subnets in new virtual networks have defaultOutboundAccess set to false by default. VMs in these private subnets need an explicit outbound method, such as a NAT gateway, to reach public endpoints. Existing virtual networks aren't changed.